Listen to this Post
The CVE-2024-42550 vulnerability involves prototype pollution in the maker.js library’s extendObject function. This function copies properties from source objects to a target object using a for…in loop without proper validation. Specifically, it lacks hasOwnProperty checks, allowing inherited properties from the prototype chain to be copied. Additionally, it does not filter dangerous keys like proto, constructor, and prototype. When a malicious source object includes such keys, their properties are copied to the target object’s prototype, polluting it. This means that properties injected via proto become accessible on the target and all objects sharing that prototype, even though they are not own properties. For example, if source.proto is set to {isAdmin: true}, after extendObject, target.isAdmin returns true via prototype inheritance, bypassing hasOwnProperty checks. This can break security-sensitive code that relies on property validation, potentially leading to authorization bypasses or other attacks. The affected code is in maker.ts lines 232-241, where the loop iterates over all enumerable properties without safeguards. This vulnerability is exploitable when extendObject processes untrusted input, such as user-controlled objects or external API data, common in configuration merging or option extension scenarios.
Platform: maker.js
Version: Prior to patch
Vulnerability: Prototype Pollution
Severity: Critical
Date: Not disclosed
Prediction: Patch pending
What Undercode Say:
Analytics:
git clone https://github.com/microsoft/maker.js.git
cd maker.js
npm install
node poc.js
const makerjs = require(‘makerjs’);
const source = { proto: { name: ‘Ravi’, isAdmin: true } };
const target = { name: ‘user’ };
const result = makerjs.extendObject(target, source);
console.log(result.name);
console.log(result.isAdmin);
how Exploit:
Craft malicious object with proto property containing desired properties. Pass to extendObject with untrusted input. Pollute prototype to bypass hasOwnProperty checks. Achieve security bypass like admin privileges.
Protection from this CVE:
Update maker.js patched version. Avoid extendObject untrusted input. Use Object.assign with filtering. Implement input validation keys.
Impact:
Security bypass risks. Unexpected behavior applications. Potential further attacks. Affects user input merging.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
