2205
Nature Type ID Name Page
CanPrecede 471 Modification of Assumed-Immutable Data (MAID) 1121
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 913 Improper Control of Dynamically-Managed Code Resources 1805
Applicable Platforms
Language : JavaScript (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
An attacker can inject attributes that are used in other
components.
High
Availability DoS: Crash, Exit, or Restart
An attacker can override existing attributes with ones that
have incompatible type, which may lead to a crash.
High
Potential Mitigations
Phase: Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification
of the prototype becomes impossible.
Effectiveness = High
While this can mitigate this weakness completely, other methods are recommended when
possible, especially in components used by upstream software ("libraries").
Phase: Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or
prototype, this weakness can be mitigated.
Effectiveness = High
Phase: Implementation
Strategy = Input Validation
When handling untrusted objects, validating using a schema can be used.
Effectiveness = Limited
Phase: Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes
by accessing the prototype via the special attributes becomes impossible, mitigating this
weakness.
Effectiveness = High
Phase: Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object
attributes, it is not possible to access the object prototype or modify it.
Effectiveness = Moderate
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-1321: Improperly Controlled Modification of
Object Prototype Attributes ('Prototype Pollution') 2206
This function sets object attributes based on a dot-separated path.
Example Language: JavaScript (Bad)
function setValueByPath (object, path, value) {
const pathArray = path.split(".");
const attributeToSet = pathArray.pop();
let objectToModify = object;
for (const attr of pathArray) {
if (typeof objectToModify[attr] !== 'object') {
objectToModify[attr] = {};
}
objectToModify = objectToModify[attr];
}
objectToModify[attributeToSet] = value;
return object;
}
This function does not check if the attribute resolves to the object prototype. These codes can be
used to add "isAdmin: true" to the object prototype.
Example Language: JavaScript (Bad)
setValueByPath({}, "__proto__.isAdmin", true)
setValueByPath({}, "constructor.prototype.isAdmin", true)
By using a denylist of dangerous attributes, this weakness can be eliminated.
Example Language: JavaScript (Good)
function setValueByPath (object, path, value) {
const pathArray = path.split(".");
const attributeToSet = pathArray.pop();
let objectToModify = object;
for (const attr of pathArray) {
// Ignore attributes which resolve to object prototype
if (attr === "__proto__" || attr === "constructor" || attr === "prototype") {
continue;
}
if (typeof objectToModify[attr] !== "object") {
objectToModify[attr] = {};
}
objectToModify = objectToModify[attr];
}
objectToModify[attributeToSet] = value;
return object;
}
Observed Examples
Reference Description
CVE-2018-3721 Prototype pollution by merging objects.
https://www.cve.org/CVERecord?id=CVE-2018-3721
CVE-2019-10744 Prototype pollution by setting default values to object attributes recursively.
https://www.cve.org/CVERecord?id=CVE-2019-10744
CVE-2019-11358 Prototype pollution by merging objects recursively.
https://www.cve.org/CVERecord?id=CVE-2019-11358
CVE-2020-8203 Prototype pollution by setting object attributes based on dot-separated path.
https://www.cve.org/CVERecord?id=CVE-2020-8203
MemberOf Relationships
CWE Version 4.14
CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context
CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context