目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-1321 类漏洞列表 229

CWE-1321 类弱点 229 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1321 原型污染漏洞属于对象属性控制不当类型。攻击者通过注入恶意输入，修改 JavaScript 对象的原型属性，从而污染全局对象或影响后续实例。这可能导致远程代码执行、拒绝服务或权限提升。开发者应避免直接合并用户输入，使用 Object.create(null) 创建无原型对象，或采用安全库限制原型修改，并严格验证输入来源，以阻断污染路径。

MITRE CWE 官方描述
CWE：CWE-1321 对象原型属性（'Prototype Pollution'）的修改控制不当 英文：产品接收来自上游组件的输入，该输入指定了要在对象中初始化或更新的属性，但它未能正确控制对对象原型（prototype）属性的修改。
常见影响 (2)
Confidentiality, Integrity, Availability Read Application Data, Modify Application Data
This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This …
Availability DoS: Crash, Exit, or Restart
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
缓解措施 (5)
Implementation By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Effectiveness: High
Architecture and Design By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Effectiveness: High
Implementation When handling untrusted objects, validating using a schema can be used.
Effectiveness: Limited
Implementation By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Effectiveness: High
Implementation Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Effectiveness: Moderate
代码示例 (1)
This function sets object attributes based on a dot-separated path.
function setValueByPath (object, path, value) { const pathArray = path.split("."); const attributeToSet = pathArray.pop(); let objectToModify = object; for (const attr of pathArray) { if (typeof objectToModify[attr] !== 'object') { objectToModify[attr] = {}; } objectToModify = objectToModify[attr]; } objectToModify[attributeToSet] = value; return object; }
Bad · JavaScript
setValueByPath({}, "__proto__.isAdmin", true) setValueByPath({}, "constructor.prototype.isAdmin", true)
Bad · JavaScript
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-4264 Dust.js 安全漏洞 — dustjs 6.3 Medium 2022-12-21
CVE-2022-39396 Parse Server 安全漏洞 — parse-server 9.8 Critical 2022-11-10
CVE-2022-41879 Parse Server 安全漏洞 — parse-server 7.2 High 2022-11-10
CVE-2022-39357 Winter 安全漏洞 — winter 8.1 High 2022-10-26
CVE-2022-29823 Feathers 安全漏洞 — Feathers-Sequalize 10.0 Critical 2022-10-25
CVE-2022-2564 Automattic Mongoose 安全漏洞 — automattic/mongoose 9.8 - 2022-07-28
CVE-2022-1295 fullpage.js 安全漏洞 — alvarotrigo/fullpage.js 9.8 - 2022-04-11
CVE-2022-0432 mastodon 安全漏洞 — mastodon/mastodon 9.6 - 2022-02-02
CVE-2021-3815 utils.js 注入漏洞 — fabiocaccamo/utils.js 9.8 - 2021-12-08
CVE-2021-3918 json-schema 安全漏洞 — kriszyp/json-schema 9.8 - 2021-11-13
CVE-2021-41097 aurelia 代码注入漏洞 — path 9.1 Critical 2021-09-27
CVE-2021-39227 ZRender 安全漏洞 — zrender 6.2 Medium 2021-09-17
CVE-2021-3805 object-path 安全漏洞 — mariocasciaro/object-path 9.1 - 2021-09-17
CVE-2021-3666 body-parser-xml 代码问题漏洞 — fiznool/body-parser-xml 9.8 - 2021-09-13
CVE-2021-3645 Github merge 安全漏洞 — viking04/merge 9.8 - 2021-09-10
CVE-2021-3766 objection.js 安全漏洞 — vincit/objection.js 9.8 - 2021-09-06
CVE-2021-3757 Immer 代码问题漏洞 — immerjs/immer 9.8 - 2021-09-02
CVE-2021-32736 ThinkJS 代码问题漏洞 — think-helper 7.5 High 2021-06-30
CVE-2021-21297 Node-Red 安全漏洞 — node-red 7.7 High 2021-02-26

CWE-1321 是常见的弱点类别，本平台收录该类弱点关联的 229 条 CVE 漏洞。