Web Hacking
Members Only
Prototype Pollution
How one missing __proto__ check in lodash.merge turns user-supplied JSON into RCE on every Node service downstream of it. The JavaScript prototype chain, the recursive-merge primitive, every published CVE class (lodash, jQuery, minimist, Kibana, tough-cookie, qs), client and server gadget enumeration, an end-to-end RCE chain via child_process.spawn, and the per-runtime fixes that actually work.
Members Only Content
This article is exclusively available to registered members of LazyHackers. Login or subscribe to read.
