Executive brief
vConsole is a debugging tool embedded in web applications. A prototype pollution vulnerability allows an attacker to inject arbitrary properties into JavaScript objects, potentially leading to application malfunction, data exposure, or remote code execution depending on how the application uses those objects.
Technical details
vConsole contains a prototype pollution vulnerability in the setOption() method in core.ts due to insufficient key validation when setting options. An attacker can call vConsole.setOption() with a malicious key such as "__proto__.foo" to modify the Object prototype. The vulnerability affects all versions prior to 3.15.1 and requires network access but no authentication. By polluting the prototype, an attacker can inject properties that affect the behavior of all objects in the application, potentially leading to arbitrary code execution or application compromise.
Affected products
- Tencent vConsole before 3.15.1
Timeline
- 2023-04-26: disclosed: Advisory published
- 2023-04-26: patched: Fixed in version 3.15.1