CVE-2020-7700: Prototype Pollution in phpjs
Summary
CVE-2020-7700: Prototype Pollution in phpjs. Affects phpjs versions < 1.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpjs is an npm package that provides PHP functions in JavaScript. It is used to bridge the gap between PHP and JavaScript, allowing developers to use PHP functions in their JavaScript code. The package is no longer maintained, and users are advised to switch to Locutus as a replacement. The vulnerability affects all versions of phpjs up to and including 1.3.2.
Vulnerability Detail
The vulnerability in phpjs is related to Prototype Pollution, which is a type of vulnerability that allows an attacker to modify the prototype of an object and inject malicious properties or methods. In this case, the vulnerability is present in the parse_str function of phpjs. By manipulating the input passed to parse_str, an attacker can modify the prototype of an object and potentially execute arbitrary code. This can lead to various security issues, including remote code execution, data tampering, and privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. The best solution is to migrate to Locutus as mentioned above.
Conclusion
The vulnerability in phpjs allows for Prototype Pollution, which can have severe security implications. It is recommended to migrate to Locutus, an actively maintained alternative, to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpjs →
FAQ
phpjs is an npm package that provides PHP functions in JavaScript. It allows developers to use PHP functions in their JavaScript code.
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and inject malicious properties or methods.
The vulnerability can lead to various security issues, including remote code execution, data tampering, and privilege escalation.
To fix the vulnerability, it is recommended to switch to Locutus, which is actively maintained and does not have this vulnerability.
There is no known workaround for this vulnerability. Migrating to Locutus is the best solution.
