|3 via 3 paths|
Find, fix and prevent vulnerabilities in your code.
- Vulnerable module: axios
- Introduced through: firstname.lastname@example.org
Introduced through: email@example.com › firstname.lastname@example.org
axios is a promise based HTTP client for the browser and node.js.
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF). An attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
A fix was pushed into the
master branch but not yet published.
- Vulnerable module: highlight.js
- Introduced through: email@example.com
Introduced through: firstname.lastname@example.org › email@example.com › firstname.lastname@example.orgRemediation: Upgrade to email@example.com.
Affected versions of this package are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable.
There are two main ways in which the pollution of prototypes occurs:
Property definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source) foreach property of source if property exists and is an object on both the target and the source merge(target[property], source[property]) else target[property] = source[property]
When the source object contains a property named
_proto_ defined with
Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of
Object and the source of
Object as defined by the attacker. Properties are then copied on the
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object:
Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to
myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
|Denial of service (DoS)||Client||This is the most likely attack.
DoS occurs when
The attacker pollutes
For example: if an attacker pollutes
|Remote Code Execution||Client||Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
|Property Injection||Client||The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for
The following environments are susceptible to a Prototype Pollution attack:
How to prevent
Freeze the prototype— use
Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.
As a best practice use
For more information on this vulnerability type:
highlight.js to version 9.18.2, 10.1.2 or higher.
- Vulnerable module: node-fetch
- Introduced through: firstname.lastname@example.org
Introduced through: email@example.com › firstname.lastname@example.org › email@example.com › firstname.lastname@example.org › email@example.com
node-fetch is an A light-weight module that brings window.fetch to node.js
Affected versions of this package are vulnerable to Denial of Service. Node Fetch did not honor the
size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.
node-fetch to version 2.6.1, 3.0.0-beta.9 or higher.