Prototype Pollution in NASAs Open MCT CVE-2023-45282

Prototype Pollution vulnerability is specific to the JavaScript programming language.

It enables an attacker to add or alter any properties of global object prototypes.

Once the property is changed, the code that inherits it will use the injected property instead of the original one.

This can be a very dangerous vulnerability that could (at best) cause a change in the client side of the application business logic or (at worst) a Remote Code Execution on the server side.

Vulnerability Assessment focused on the Open MCT software in the context of a particular class of vulnerabilities characteristic of JavaScript for front- and back-end applications.

The vulnerability was communicated to NASA and promptly fixed by their development team.

The problem was also reported to MITRE and can be tracked by the ID CVE-2023-45282.

Prototype Pollution vulnerability can be mitigated by providing an additional check in the function responsible for object deep instantiation.

For instance, a condition could be introduced to verify whether the imported object has the explicit __proto__ property and delete it if it is true.

Using third -party libraries for deep copy/merge/clone of JavaScript objects is generally recommended.