CVE-2020-7719: Prototype Pollution in locutus
Summary
CVE-2020-7719: Prototype Pollution in locutus. Affects locutus versions < 2.0.12. Fixed in 2.0.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Locutus is an npm package that provides JavaScript functions for PHP. It allows developers to use PHP functions in JavaScript applications. The package is widely used and provides a convenient way to bridge the gap between PHP and JavaScript. However, versions prior to 2.0.12 of locutus are vulnerable to Prototype Pollution through the php.strings.parse_str function.
Vulnerability Detail
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and inject malicious properties or methods. In the case of locutus, the vulnerability exists in the php.strings.parse_str function, which is used to parse query strings. By manipulating the query string, an attacker can inject malicious properties into the resulting object, leading to potential security issues such as remote code execution or information disclosure.
How To Fix
Minimum fixed version
2.0.12
This is the first release that contains the fix.
npm install locutus@2.0.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of locutus to mitigate the risk of exploitation.
Conclusion
In conclusion, the locutus package prior to version 2.0.12 is vulnerable to Prototype Pollution. It is crucial for developers to update their dependencies to the latest version of locutus to mitigate the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for locutus →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and inject malicious properties or methods.
The vulnerability in locutus can lead to potential security issues such as remote code execution or information disclosure.
Yes, updating locutus to version 2.0.12 or later fixes this vulnerability.
There are no known workarounds for this vulnerability. Updating to the latest version of locutus is the recommended solution.
For more information about this vulnerability, you can visit the Vulert Playground at Vulert Scanner
References
Related vulnerabilities
Recent vulnerabilities recorded for locutus.
