Prototype Pollution

Vulnerability

Overview

CVE-2020-7719 describes a prototype pollution vulnerability in the Locutus JavaScript library (versions before 2.0.12). Locutus ports standard library functions from PHP and other languages to TypeScript/JavaScript. The flaw resides in the php.strings.parse_str function, which parses query strings into JavaScript objects without sanitizing keys that can modify the prototype chain [1].

Exploitation

An attacker can exploit this by supplying a crafted string to parse_str that includes keys such as __proto__, constructor, or prototype. When the function processes the input, it assigns values directly to the object's prototype, polluting Object.prototype [3]. No authentication or special network position is required if the application exposes parse_str to user-controlled input.

Impact

Successful prototype pollution can lead to denial of service by triggering JavaScript exceptions or, more critically, remote code execution. Because all JavaScript objects inherit from Object.prototype, a polluted prototype can alter application behavior globally, potentially forcing code paths chosen by the attacker [4].

Mitigation

The vulnerability was fixed in Locutus version 2.0.12. The fix, implemented in pull request #418, adds input validation that checks for prototype keywords and returns the object unmodified if they are present [3]. Users are strongly advised to upgrade to the latest version. No workarounds are documented.