JavaScript Prototype Pollution in oro/platform

Vulnerability

OroPlatform versions prior to 4.2.8 are affected by a client-side JavaScript prototype pollution vulnerability [1][2]. By sending a specially crafted request, an attacker can inject properties into existing JavaScript language construct prototypes, such as objects [1]. The vulnerability resides in the setValue function within src/Oro/Bundle/UIBundle/Resources/public/js [4]. The fix adds a check to prevent setting properties on __proto__ [4].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request containing strings like __proto__, constructor[prototype], or constructor.prototype [1]. No authentication is required, and the attack can be performed remotely with low complexity [2]. The attacker does not need user interaction beyond the victim accessing a page that processes the malicious request [2].

Impact

Successful exploitation allows an attacker to pollute the Object prototype, which can lead to JavaScript code execution by libraries that are vulnerable to prototype pollution [1]. This can result in compromise of confidentiality, integrity, and availability depending on the application context [2]. The scope may change as the vulnerable component can impact resources beyond its security scope [2].

Mitigation

The issue has been patched in OroPlatform version 4.2.8 [1]. Users unable to upgrade can configure a firewall to drop requests containing the strings __proto__, constructor[prototype], and constructor.prototype [1]. The commit 62c2693 implements the fix by adding a check in the setValue function [4].