Prototype Pollution RCE/DoS in mongo-object <3.0.3

Prototype Pollution Vulnerability Overview Prototype Pollution is a vulnerability affecting JavaScript. It allows attackers to modify the prototype chain of JavaScript objects by injecting other values into , thereby polluting or tampering with the prototype of JavaScript objects. This can lead to Denial of Service (DoS) or Remote Code Execution (RCE). Scope Package Name: Affected Versions: <3.0.3 CVSS Score: 6.3 (Medium) Snyk ID: SNYK-JS-MONGOOBJECT-13816714 Remediation Upgrade to version 3.0.3 or higher. Details Vulnerability Type Prototype Pollution is a vulnerability affecting JavaScript. It allows attackers to modify the prototype chain of JavaScript objects by injecting other values into , thereby polluting or tampering with the prototype of JavaScript objects. This can lead to Denial of Service (DoS) or Remote Code Execution (RCE). Exploitation Techniques 1. Unsafe Recursive Object Merging - Attackers can pollute by controlling the property name in the object. - Example code: 2. Property Definition by Path - Attackers can set by controlling the parameter, thereby polluting . - Example code: Attack Vectors Denial of Service (DoS): Attackers cause code execution failures by polluting certain properties within . Remote Code Execution (RCE): Attackers execute malicious code by polluting certain properties within . Property Injection: Attackers gain access to sensitive information or escalate privileges by polluting certain properties within . Affected Environments Application Servers Web Servers Web Browsers Preventive Measures 1. Freeze the prototype: Use . 2. Require schema validation for JSON input. 3. Avoid using unsafe recursive merge functions. 4. Consider using objects without prototypes (e.g., ) to break the prototype chain and prevent pollution. 5. As a best practice, use instead of . References GitHub Commit GitHub Issue Vulnerable Code CVSS Base Score Attack Vector (AV): Network Attack Complexity (AC): Low Attack Requirements (AT): Present Privileges Required (PR): None User Interaction (UI): None Confidentiality (VC): None Integrity (VI): Low Availability (VA): None Confidentiality (SC): None Integrity (SI): Low Availability (SA): None

Goal Reached Thanks to every supporter — we hit 100%!

Prototype Pollution RCE/DoS in mongo-object <3.0.3