Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prototype Pollution Vulnerability in "json8-merge-patch" #113

Closed
gkmr507 opened this issue Sep 12, 2020 · 4 comments · Fixed by #114
Closed

Prototype Pollution Vulnerability in "json8-merge-patch" #113

gkmr507 opened this issue Sep 12, 2020 · 4 comments · Fixed by #114

Comments

@gkmr507
Copy link

gkmr507 commented Sep 12, 2020 •
edited
Loading

Prototype Pollution:
This package fails to restrict access to prototypes of objects, allowing for modification of prototype behavior, which may allow obtaining sensitive information/DoS/RCE.

If required I can submit a POC through a secured channel. Thanks.
@sonnyp
Copy link
Owner

sonnyp commented Sep 12, 2020

If required I can submit a POC through a secured channel. Thanks.

Yes please, email in my profile.

@sonnyp
Copy link
Owner

sonnyp commented Sep 12, 2020

Never mind, I could reproduce - working on a fix.

@sonnyp sonnyp mentioned this issue Sep 12, 2020
Merged
@gkmr507
Copy link
Author

gkmr507 commented Sep 13, 2020

Thanks for the quick response and fix. But the issue is still reproducible. Sent a mail with POC(how to reproduce) and opened an issue in HackerOne as well.
Ref: https://hackerone.com/reports/980649

@sonnyp
Copy link
Owner

sonnyp commented Sep 13, 2020

Oops sorry about that I went too fast.

Fixed in 1.0.3

Thank you for the report.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

json8-merge-patch: Prevent prototype pollution sonnyp/JSON8
2 participants
@sonnyp @gkmr507