CVE-2023-26158
📋 TL;DR
CVE-2023-26158 is a prototype pollution vulnerability in the mockjs package that allows attackers to modify JavaScript object prototypes through user-controlled inputs. This can lead to denial of service, data corruption, or potentially remote code execution by polluting built-in object methods. All applications using mockjs are affected.
💻 Affected Systems
- mockjs
📦 What is this software?
Mock.js by Mockjs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through prototype pollution leading to complete system compromise
Likely Case
Denial of service, application crashes, or data corruption through polluted object methods
If Mitigated
Limited impact with proper input validation and prototype pollution protections
🎯 Exploit Status
Simple prototype pollution exploitation with publicly available proof-of-concept
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://security.snyk.io/vuln/SNYK-JS-MOCKJS-6051365
Restart Required: No
Instructions:
No official patch available. Apply workaround or migrate to alternative library.
🔧 Temporary Workarounds
Add prototype pollution protection to Util.extend
allModify the Util.extend function to block dangerous prototype properties
Add this line inside the for (name in options) loop: if (["__proto__", "constructor", "prototype"].includes(name)) continue
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs passed to mockjs functions
- Use Object.freeze() on critical object prototypes or implement runtime monitoring for prototype modifications
🔍 How to Verify
Check if Vulnerable:
Check package.json for mockjs dependency and verify if Util.extend function lacks prototype pollution protectionCheck Version:
npm list mockjsVerify Fix Applied:
Verify the Util.extend function includes the prototype property denylist check📡 Detection & Monitoring
Log Indicators:
- Unusual application crashes, unexpected prototype modifications, or errors in object property access
Network Indicators:
- Unusual payloads containing __proto__, constructor, or prototype properties in requests
SIEM Query:
Search for requests containing __proto__, constructor, or prototype in payloads to mockjs endpoints🔗 References
- https://github.com/nuysoft/Mock/blob/00ce04b92eb464e664a4438430903f2de96efb47/dist/mock.js%23L721-L755
- https://security.snyk.io/vuln/SNYK-JS-MOCKJS-6051365
- https://github.com/nuysoft/Mock/blob/00ce04b92eb464e664a4438430903f2de96efb47/dist/mock.js%23L721-L755
- https://security.snyk.io/vuln/SNYK-JS-MOCKJS-6051365
