CVE-2019-10768 in Angular libs < 1.7.9
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| OpenStack Dashboard (Horizon) |
New
|
Undecided
|
Unassigned | ||
| OpenStack Security Advisory |
Won't Fix
|
Undecided
|
Unassigned | ||
Bug Description
Our organisation was contacted by an ethical hacker - notifying about security vulnerability. Wallaby Horizon seems to be vulnerable to prototype pollution, identified in CVE-2019-10768.
"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload."
We'd need to update Xstatic-angular above 1.7.9 - which I think happens in:
https:/
We should backport this back down to Wallaby/Xena if possible.
_______
Details from original message below:
Summary :
An object.prototype pollution vulnerability exists in the Angular JS used in the website.In AngularJS there are some versions that have the function merge() which can be used by an attacker for adding or modifying properties of Object.prototype using a __proto__ payload.
Steps to Reproduce:
Step 1: Enter the following URL https:/
Step 2: Press F12 or Right-click and click on inspect element
Step 3: Enter the below payload in the console.
Payloads:
angular.merge({}, JSON.parse(
console.
Step 4: Now check if console.log outputs the "polluted".
Impact:
The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution, Property Injection.
References materials:
https:/
https:/
CVE References
| description: | updated |
| Jeremy Stanley (fungi) wrote | #1 |
| description: | updated |
| Changed in ossa: | |
| status: | New → Incomplete |
| Jeremy Stanley (fungi) wrote | #2 |
| Akihiro Motoki (amotoki) wrote | #3 |
| description: | updated |
| Changed in ossa: | |
| status: | Incomplete → Won't Fix |
| information type: | Private Security → Public Security |
Since this report concerns a possible security risk, an incomplete
security advisory task has been added while the core security
reviewers for the affected project or projects confirm the bug and
discuss the scope of any vulnerability along with potential
solutions.