CWE-1321
Improperly Controlled Modification of Object Prototype Attributes
2020-12-10
00h00 +00:00
00h00 +00:00
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Improperly Controlled Modification of Object Prototype Attributes
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
一般情報
導入モード
Architecture and DesignImplementation : This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
適用可能なプラットフォーム
言語
名前： JavaScript (Undetermined)一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Confidentiality Integrity Availability | Read Application Data, Modify Application Data 注記：This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This creates attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of the object prototype (such as hasOwnProperty, toString, or valueOf). | High |
| Availability | DoS: Crash, Exit, or Restart 注記：An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash. | High |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2018-3721 | Prototype pollution by merging objects. |
CVE-2019-10744 | Prototype pollution by setting default values to object attributes recursively. |
CVE-2019-11358 | Prototype pollution by merging objects recursively. |
CVE-2020-8203 | Prototype pollution by setting object attributes based on dot-separated path. |
潜在的な緩和策
Phases : ImplementationBy freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Phases : Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Phases : Implementation
When handling untrusted objects, validating using a schema can be used.
Phases : Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Phases : Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
検出方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)有効性 : High
脆弱性マッピングノート
理由 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
関連する攻撃パターン
| CAPEC ID | 攻撃パターン名 |
|---|---|
| CAPEC-1 | Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to. |
| CAPEC-180 | Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack. |
| CAPEC-77 | Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables. |
参考文献
REF-1148
Prototype pollution attack in NodeJS applicationOlivier Arteau.
https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf
REF-1149
What is Prototype Pollution?Changhui Xu.
https://codeburst.io/what-is-prototype-pollution-49482fc4b638
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| Anonymous External Contributor | 4.3 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Diagram, Modes_of_Introduction | |
| CWE Content Team | MITRE | updated Detection_Factors, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Alternate_Terms, Name |
