fix: prototype pollution vulnerability in extend (CVE-2024-45435)

[andersk]

• Fixes [Bug]: Prototype Pollution Vulnerability Affecting chartist module, versions >=1.0.0 <=1.3.0 #1427.

https://nvd.nist.gov/vuln/detail/CVE-2024-45435
https://gist.github.com/tariqhawis/c67177164d3b7975210caddb25b60d62

[tariqhawis]

Hi @andersk ,

Thank you for your feedback regarding the report. I would like to highlight an additional prototype accessor: constructor.prototype. A potential injection could look like this:

extend ({}, JSON.parse('{"constructor":{"prototype":{"polluted":yes}}}'))"

Checking for the presence of constructor in the input should be sufficient.

Best,
Tariq

[andersk]

Checking for the presence of constructor in the input should be sufficient.

Nope, it’s not.

extend({}, {"hasOwnProperty": {"polluted": "yes"}});
console.log(Object.prototype.hasOwnProperty.polluted); // → yes

I’ve pushed a more complete fix.