Popular jQuery JavaScript library impacted by prototype pollution flaw

guest · Apr 21, 2019

Popular jQuery JavaScript library impacted by prototype pollution flaw
Prototype pollution flaws are "the next big thing" in JavaScript security research
April 21, 2019
https://www.zdnet.com/article/popul...library-impacted-by-prototype-pollution-flaw/

Three years after its last major security bug, the jQuery JavaScript library --used on 74 percent of all internet sites-- has received another security patch this week.

This security update addresses a rare vulnerability --called prototype pollution-- that security researchers are only now starting to understand and discover in more and more JavaScript libraries.
An attacker that manages to alter a JavaScript object prototype can severely impact how data is processed by the rest of the application, and open the door for more dangerous attacks, such as application crashes (denial of vulnerability bugs) or application hijacks (code execution flaws).

In a report published last week, Tal and the Snyk team described and released proof of concept code for a prototype pollution attack (CVE-2019-11358) impacting jQuery. To show how dangerous this vulnerability is, they showed how a prototype pollution flaw could allow attackers to assign themselves admin rights on a web app that uses jQuery code for its frontend.
Click to expand...

Log in or Sign up

Popular jQuery JavaScript library impacted by prototype pollution flaw

guest Guest

Log in or Sign up

Popular jQuery JavaScript library impacted by prototype pollution flaw

guest Guest

Useful Searches