The Prototype Pollution vulnerability is specific to the JavaScript programming language. It enables an attacker to add or alter any properties of global object prototypes. Once the property is changed, the code that inherits it will use the injected property instead of the original one. This can be a very dangerous vulnerability that could
The original post: /r/space by /u/andy-codes on 2024-11-23 01:11:13.

In the article, I discuss a prototype pollution vulnerability (CVE-2023-45282) found in NASA’s Open MCT. This flaw in JavaScript allows attackers to alter object prototypes, potentially leading to serious outcomes like privilege escalation or remote code execution (RCE). I explain how the vulnerability occurs in the “Import from JSON” feature, which can crash the application or lead to more dangerous exploits. Fortunately, NASA responded quickly to fix the issue, but it highlights the importance of securing deep merge operations in JavaScript.

This security research was originally published at the following link: https://andy.codes/blog/security_articles/2023-10-12-prototype-pollution-in-nasas-open-mct.html