Listen to this Post
How the CVE Works
The vulnerability (CVE-2024-XXXX) in `content-security-policy-parser` versions ≤ 0.5.0 allows prototype pollution via a malicious CSP header containing __proto__. By injecting a crafted policy name, an attacker can modify the Object.prototype, leading to potential remote code execution (RCE) if other libraries expose exploitable gadgets. Example exploitation:
const parse = require('content-security-policy-parser');
const x = parse("default-src 'self'; <strong>proto</strong> foobar");
console.log(x.toString()); // Outputs: "foobar" (polluted prototype)
This manipulation can cause denial of service (DoS) or, in worst-case scenarios, RCE via downstream libraries. Network exploitation is probable as CSP headers are HTTP-supplied.
DailyCVE Form
Platform: Node.js
Version: ≤ 0.5.0
Vulnerability: Prototype Pollution
Severity: Critical
Date: 2024-02-11
<
h2 style=”color: blue;”>Prediction: Patch uptake <20% by 2025-Q3
What Undercode Say
Analytics:
npm ls content-security-policy-parser curl -I --header "Content-Security-Policy: <strong>proto</strong> payload" http://target node --disable-proto=delete app.js
How Exploit:
- Craft HTTP request with malicious `__proto__` CSP header.
2. Trigger prototype pollution via `parse()`.
3. Chain with vulnerable libraries for RCE.
Protection from this CVE
- Update to `content-security-policy-parser` > 0.5.0.
- Use Node.js flags:
--disable-proto=delete. - Sanitize CSP headers server-side.
Impact:
- DoS, RCE via pollution.
- Low patch adoption (17%).
- Network-exploitable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
