CVE-2020-7643: Prototype Pollution in paypal-adaptive
Summary
CVE-2020-7643: Prototype pollution in paypal-adaptive. Affects paypal-adaptive versions < 0.4.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
paypal-adaptive is an npm package that provides functionality for integrating PayPal's Adaptive Payments API into JavaScript applications. It allows developers to create and manage payments, refunds, and other related operations. The package is vulnerable to a prototype pollution attack, which can lead to the manipulation of JavaScript objects and the addition or modification of properties on Object.prototype.
Vulnerability Detail
The vulnerability in paypal-adaptive (version 0.4.2 and below) arises from a lack of proper input validation and sanitization. An attacker can exploit this by injecting a payload using the proto property, tricking the PayPal function into modifying or adding properties to the Object.prototype. This can result in unexpected behavior, such as the modification of existing object properties or the addition of new properties that can be abused for further attacks. The impact of this vulnerability can vary depending on how the affected code uses the manipulated objects.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually sanitize and validate input before passing it to the vulnerable code. This involves checking for and removing any malicious proto properties from the input objects. Here's an example of how this can be done in JavaScript:
function sanitizeInput(input) {
if (typeof input === 'object' && input !== null) {
delete input.__proto__;
for (const key in input) {
if (Object.prototype.hasOwnProperty.call(input, key)) {
sanitizeInput(input[key]);
}
}
}
}
Conclusion
The paypal-adaptive package (version 0.4.2 and below) is vulnerable to prototype pollution, which can be exploited to manipulate JavaScript objects and modify properties on Object.prototype. To mitigate this vulnerability, it is crucial to update the package to a version higher than 0.4.2. Additionally, developers can sanitize and validate input to prevent the injection of malicious proto properties. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for paypal-adaptive →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can manipulate the prototype of an object. By modifying the prototype, the attacker can affect the behavior of all instances of that object, potentially leading to unexpected and malicious behavior.
Object.prototype is a built-in JavaScript object that serves as the prototype for all objects in JavaScript. It contains common properties and methods that are inherited by all objects.
An attacker can exploit this vulnerability by injecting a payload using the proto property. This payload can modify or add properties to the Object.prototype, leading to unexpected behavior in the code that uses the manipulated objects.
The consequences of this vulnerability can vary depending on how the affected code uses the manipulated objects. It can lead to unexpected behavior, data corruption, privilege escalation, or further exploitation of other vulnerabilities.
Yes, this vulnerability has been fixed in versions of paypal-adaptive higher than 0.4.2. It is recommended to update to the latest version to mitigate the risk.
