3 ms·
If an attacker is in a position to exploit prototype pollution then you’re already screwed. They can already execute any code they want. Seems like this resea
by mr_toad 5y ago
If an attacker is in a position to exploit prototype pollution then you’re already screwed. They can already execute any code they want. Seems like this research is just an overly complicated way of saying water is wet.
- ridiculous_fish 5y agoThis vulnerability does not require the attacker to have execute permissions. It relies on the server decoding user-supplied JSON (which should be safe), and then having a code path which assigns "through" those keys. Any sort of object-merge library is a candidate for being vulnerable.
- olliej 5y agoEven if you could initialize the prototype of an object from JSON deserialisation (which I’m not sure you can), JSON very explicitly lacks the ability to set accessor properties. So any injected property is still a normal property for which regular read and write rules apply