Executive Summary

This vulnerability exists in the Locutus library, specifically in the unserialize() function of locutus/php/var/unserialize prior to version 3.0.25. When deserializing PHP serialized data, the function assigns keys to plain JavaScript objects without filtering out the __proto__ key. If an attacker includes __proto__ as a key in the serialized payload, it triggers JavaScript's __proto__ setter, which replaces the object's prototype with attacker-controlled content. This leads to prototype pollution, enabling property injection, propagation of injected properties during for...in loops, and potential denial of service by overriding built-in methods.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to inject properties into objects via prototype pollution. This can cause unexpected behavior in the application, including the propagation of malicious properties through object iterations and denial of service by overriding critical built-in methods. Such impacts can compromise application stability and security.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Locutus to version 3.0.25 or later, where the issue with the unserialize() function assigning deserialized keys without filtering the __proto__ key has been patched.

Useful 0 Not Useful 0