Comments (3)
FYI, doing Object.create(null)
isn't enough as there are other ways to get at the Object.prototype. jQuery fixed this by preventing any __proto__
key part.
For example, here are other vulnerable query strings:
foo[0]=bar&foo[__proto__][__proto__][test]=polluted
foo=bar&foo=baz&foo[__proto__][__proto__][test]=polluted
foo=bar&foo[__proto__][__proto__][test]=polluted
from jquery-bbq.
Hi there,
Unfortunately in https://github.com/cowboy/jquery-bbq/blob/master/jquery.ba-bbq.min.js the prototype pollution is still there and can be launched from the client side (different from the above case which seems to be launched from the server side).
Just check the codes "R=R[S]=P<Q?R[S]||(U[P+1]&&isNaN(U[P+1])?{}:[]):M" in that file. Object.prototype is polluted when some website vulnerable.com is using this library and someone visits https://vulnerable.com/?__proto__[Key]=pollute. Hopefully you can patch that line of code.
Actually I have discovered 6 real-world websites that are using this library and hence having this vulnerability. But I'm not going to disclose them here for the sake of their security. Thanks!
from jquery-bbq.
hello, i already reflected this xss on the client website,
Object.prototype.div=['1','']
$('
when i use this snippet in browser console it popup a screen "1" .
now it create self xss, i need to draft the code to exploit user upon click.
BugBountyTIP.
from jquery-bbq.
Related Issues (20)
- deparam.querystring() returns abnormal results for URLs without a query string HOT 1
- jQuery.param.querystring (build url) should use recursive merge (aka. deep copy).
- removeState & param.fragment questions
- 'window' parameter for module
- Doesn't work on Windows Phone (IE9 Mobile)
- How to display filled forms submitted via ajax when back button clicked
- Merging content on links
- Loading content and animation
- Get into bower! HOT 10
- Integrate with filtrify.js HOT 1
- release jquery-bbq-v1.3
- BBQ dead? HOT 8
- Can qs be part of state
- Uncaught TypeError: Cannot read property 'msie' of undefined HOT 5
- css breaks javascript on android 4.2
- Exception when loaded -- jquery.ba-bbq.min.js:formatted:197 Uncaught TypeError: Cannot read property 'msie' of undefined HOT 1
- TypeError: browser is undefined
- Add support of jQuery 3
- Is the LICENSE "MIT & GPL" or "MIT OR GPL"? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jquery-bbq.