Executive brief
phpjs is a JavaScript library that replicates PHP functionality in JavaScript environments. The library contains a prototype pollution vulnerability in its parse_str function that allows attackers to modify the base JavaScript object prototype, potentially affecting the behavior of all objects in an application and leading to unauthorized data modification, denial of service, or remote code execution depending on how the polluted properties are used downstream.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the parse_str function of phpjs, which parses URL-encoded parameter strings without proper validation of property names. An attacker can supply a malicious input such as `__proto__[polluted]=true` to pollute the Object prototype and inject arbitrary properties into all JavaScript objects in the application. No authentication is required; the attack is triggered by providing crafted input to parse_str. Successful exploitation can lead to modification of application logic, denial of service through property overwrites, or remote code execution if polluted properties are later used in dangerous contexts. There is no patched version; phpjs is unmaintained and users are advised to migrate to Locutus as a replacement.
Affected products
- phpjs phpjs up to and including 1.3.2
Timeline
- 2020-08-14: disclosed
- 2021-05-06: advisory