Prototype pollution vulnerability about jquery-bbq

[mhofman]

FYI, doing Object.create(null) isn't enough as there are other ways to get at the Object.prototype. jQuery fixed this by preventing any __proto__ key part.

For example, here are other vulnerable query strings:
foo[0]=bar&foo[__proto__][__proto__][test]=polluted
foo=bar&foo=baz&foo[__proto__][__proto__][test]=polluted
foo=bar&foo[__proto__][__proto__][test]=polluted

[zifeng-kang]

Hi there,

Unfortunately in https://github.com/cowboy/jquery-bbq/blob/master/jquery.ba-bbq.min.js the prototype pollution is still there and can be launched from the client side (different from the above case which seems to be launched from the server side).

Just check the codes "R=R[S]=P<Q?R[S]||(U[P+1]&&isNaN(U[P+1])?{}:[]):M" in that file. Object.prototype is polluted when some website vulnerable.com is using this library and someone visits https://vulnerable.com/?__proto__[Key]=pollute. Hopefully you can patch that line of code.

Actually I have discovered 6 real-world websites that are using this library and hence having this vulnerability. But I'm not going to disclose them here for the sake of their security. Thanks!

[mzjoker85]

hello, i already reflected this xss on the client website,
Object.prototype.div=['1','']
$('

')
when i use this snippet in browser console it popup a screen "1" .
now it create self xss, i need to draft the code to exploit user upon click.
BugBountyTIP.