Vulnerability Report: JQuery CVE-2019-11358

A new security vulnerability--a “prototype pollution” vulnerability--affecting a jQuery frontend library has recently been detected (CVE-2019-11358) that could allow a hacker to assign themselves admin rights on a web app that uses jQuery code for its frontend. Although this vulnerability has been patched, researchers have also published proof-of-concept demonstrating how this vulnerability could be exploited. jQuery is used in 97% of all websites that use at least one JavaScript library.

Recommendations

• Patch to jQuery v3.4.0, which addresses this vulnerability
• Ensure you are using safe recursive merge implementations
• Consider creating objects without a prototype to avoid them being susceptible to prototype pollution attacks
• Avoid using square bracket notation when working with user-controlled data, and at all if possible

Details

This security vulnerability enables attackers to overwrite a JavaScript application object prototype. When that happens, properties that are controlled by the attacker can be injected into objects and then either lead to denial of service by triggering JavaScript exceptions, or tamper with the application source code to force the code path that the attacker injects.

Although proof-of-concept code exists for this vulnerability, each use of the exploit requires fine tuning, inhibiting wide scale use. Prototype pollution flaws require that attackers have in-depth knowledge of how each website works with its object prototypes, and how these prototypes factor in the grand scheme of things.