CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
常见后果
影响范围: Confidentiality Integrity Availability
技术影响: Read Application Data Modify Application Data
说明: This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This creates attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of the object prototype (such as hasOwnProperty, toString, or valueOf).
影响范围: Availability
技术影响: DoS: Crash, Exit, or Restart
说明: An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
潜在缓解措施
阶段: Implementation
描述: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
有效性: High
阶段: Architecture and Design
描述: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
有效性: High
阶段: Implementation
策略: Input Validation
描述: When handling untrusted objects, validating using a schema can be used.
有效性: Limited
阶段: Implementation
描述: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
有效性: High
阶段: Implementation
描述: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
有效性: Moderate
观察示例
参考: CVE-2018-3721
Prototype pollution by merging objects.
参考: CVE-2019-10744
Prototype pollution by setting default values to object attributes recursively.
参考: CVE-2019-11358
Prototype pollution by merging objects recursively.
参考: CVE-2020-8203
Prototype pollution by setting object attributes based on dot-separated path.
引入模式
| 阶段 | 说明 |
|---|---|
| Architecture and Design | - |
| Implementation | This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively. |
适用平台
编程语言
关键信息
CWE ID: CWE-1321
抽象级别: Variant
结构: Simple
状态: Incomplete