Security Fix for Prototype Pollution - huntr.dev

[huntr-helper]

@zpbrent (https://huntr.dev/users/zpbrent) has fixed a potential Prototype Pollution vulnerability in your repository 🔨. For more information, visit our website (https://huntr.dev/) or click the bounty URL below...

Q | A
Version Affected | *
Bug Fix | YES
Original Pull Request | 418sec#1

If you are happy with this disclosure, we would love to get a CVE assigned to the vulnerability. Feel free to credit @zpbrent, the discloser found in the bounty URL (below) and @huntr-helper.

User Comments:

📊 Metadata *

mquery is aware of the risk of prototype pollution in its exported functions cloneObject() and merge() and readily present protection by checking the key in var specialProperties = ['__proto__', 'constructor', 'prototype']. However, the current protection misses to protect another exported function mergeClone(). As a result, the latest version 3.2.4 is still vulnerable to prototype pollution.

Bounty URL: https://www.huntr.dev/bounties/1-npm-mquery/

⚙️ Description *

Filter out specialProperties = ['__proto__', 'constructor', 'prototype'] .

💻 Technical Description *

Place the protection code in mergeClone():
if (specialProperties.indexOf(key) !== -1) { continue; }

🐛 Proof of Concept (PoC) *

// PoC.js version of mquery is 3.2.4
mquery = require('mquery');
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mquery.utils.mergeClone({}, JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // HACKED

🔥 Proof of Fix (PoF) *

// PoC.js version of mquery is 3.2.4
mquery = require('mquery');
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mquery.utils.mergeClone({}, JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // undefined

👍 User Acceptance Testing (UAT)

N/A

🔗 Relates to...

https://www.huntr.dev/bounties/1-npm-mquery/

[vkarpov15]

Thanks 👍

Just to alleviate concerned readers, this does not affect Mongoose, Mongoose has its own mergeClone() that was fixed in Automattic/mongoose@22ad62a