Sign In
Advisories

Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()

Go back
Severity
high
Date
Affecting

  • padloc >= 4.0.0, < 4.3.1

CWE
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS
7.0
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H
Credit
Zachariah Mithani (AploSec)
Description
Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo