A dangerous vulnerability has been fixed in the popular jQuery JavaScript library, which is used by 74% of websites. Web developers are encouraged to update jQuery in their projects to version 3.4.0.
This is a rare prototype pollution vulnerability, the essence of which security researchers began to understand only now (for the first time, the prototype pollution vulnerability was documented last year). The name of the problem speaks for itself - with its help, an attacker can modify the prototype of a JavaScript object.
JavaScript object prototypes are like variables, except that instead of a single value (var car = "Fiat"), they can contain multiple values based on a predefined structure (var car ={type:"Fiat", model:"500", color:"white "}). Prototypes set the structure and default values for objects so that the application does not crash if no values have been set. Making changes to an object's prototype can seriously affect the processing of data by an application and pave the way for other, even more dangerous attacks.
A prototype pollution vulnerability in jQuery (CVE-2019-11358) was discovered by researchers at Snyk. Last week they postedPoC exploit and demonstrated how it can be used by an attacker to gain administrator rights in a web application using jQuery.
Be that as it may, prototype pollution vulnerabilities are very difficult to exploit, since the attacker must perform very subtle manipulations with each individual code.
PoC
CALC_POP.TXT [PAYLOAD] find-vuln.sh
find-vulb.js
This is a rare prototype pollution vulnerability, the essence of which security researchers began to understand only now (for the first time, the prototype pollution vulnerability was documented last year). The name of the problem speaks for itself - with its help, an attacker can modify the prototype of a JavaScript object.
JavaScript object prototypes are like variables, except that instead of a single value (var car = "Fiat"), they can contain multiple values based on a predefined structure (var car ={type:"Fiat", model:"500", color:"white "}). Prototypes set the structure and default values for objects so that the application does not crash if no values have been set. Making changes to an object's prototype can seriously affect the processing of data by an application and pave the way for other, even more dangerous attacks.
A prototype pollution vulnerability in jQuery (CVE-2019-11358) was discovered by researchers at Snyk. Last week they postedPoC exploit and demonstrated how it can be used by an attacker to gain administrator rights in a web application using jQuery.
Be that as it may, prototype pollution vulnerabilities are very difficult to exploit, since the attacker must perform very subtle manipulations with each individual code.
PoC
CALC_POP.TXT [PAYLOAD] find-vuln.sh
find-vulb.js