# CVE-2021-44906
Originally from: https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip
## Run
```
npm run hack
```
And you will see the any function's done property is changed to true.
The explanation of command line `node index.js --_.concat.constructor.prototype.done true`:
- `--` is the hypen mark normally used in command line arguments.
- `_` is the built in key in minimist: https://github.com/minimistjs/minimist/blob/v1.2.5/index.js#L37
- `.concat.constructor.prototype.done true` will `set _.concat.constructor.prototype.done` to `true`.
Because `_.concat.constructor` is a `Function` type, all `Function`'s prototype will be added by a property called `done`.
The reason why the prototype chain is this long is that in the previous fixes, the developer banned `__proto__`, `Arrary.prototype`, `Object.prototype`, `Number.prototype` and `String.prototype`. So we have to use `constructor` who has prototype property and which is not blacklisted.
Another example is:
```
npm run hack2
```
However, in the above two example, we can only tamper values but not functions' definition.
## Cause
In the fix for CVE-2020-7598 (1.2.2), and in 1.2.3 the developer already fixed some vulnerability by checking `__proto__`, `Arrary.prototype`, `Object.prototype`, `Number.prototype`, `String.prototype`,
but they forgot to check `Function.prototye`. This is why this exploit can only affect the property of `Function`.
For the fix of this CVE, the developer checked the `Function.prototype` as well as `constructor`: https://github.com/minimistjs/minimist/blob/v1.2.6/index.js#L73
[4.0K] /data/pocs/6c84b468bab2ad352b1b5b5ab8075c474c936766
├── [ 666] index.js
├── [4.0K] node_modules
│ └── [4.0K] minimist
│ ├── [4.0K] example
│ │ └── [ 69] parse.js
│ ├── [7.9K] index.js
│ ├── [1.0K] LICENSE
│ ├── [ 883] package.json
│ ├── [2.4K] readme.markdown
│ └── [4.0K] test
│ ├── [ 756] all_bool.js
│ ├── [4.1K] bool.js
│ ├── [ 980] dash.js
│ ├── [ 778] default_bool.js
│ ├── [ 588] dotted.js
│ ├── [ 376] kv_short.js
│ ├── [ 779] long.js
│ ├── [ 909] num.js
│ ├── [4.5K] parse.js
│ ├── [ 238] parse_modified.js
│ ├── [1.2K] proto.js
│ ├── [1.6K] short.js
│ ├── [ 328] stop_early.js
│ ├── [2.5K] unknown.js
│ └── [ 191] whitespace.js
├── [ 484] package.json
├── [ 828] package-lock.json
└── [1.6K] README.md
4 directories, 24 files