Popular jQuery JavaScript library impacted by prototype pollution flaw

Three years after its last major security bug, the jQuery JavaScript library –used on 74 percent of all internet sites— has received another security patch this week. This security update addresses a rare vulnerability –called prototype pollution– that security researchers are only now starting to understand and discover in more and more JavaScript libraries. As the name suggests, prototype pollution refers to an attacker’s ability to modify a JavaScript object’s prototype. More from ZDNET JavaScript objects are like variables, but instead of storing one value (var car = “Fiat”), they can contain multiple values based on a predefined structure (var car ={type:”Fiat”, model:”500″, color:”white”}). Prototypes define a JavaScript object’s default structure and default values, so applications don’t crash when no values are set. An attacker that manages to alter a JavaScript object prototype can severely impact how data is processed by the rest of the application, and open the door for more dangerous attacks, such as application crashes (denial of vulnerability bugs) or application hijacks (code execution flaws). Prototype pollution attacks aren’t new and have first been documented years ago. However, they are only now being thoroughly cataloged because JavaScript, as a language, has evolved from handling basic UI interactions to working with impressive amounts of sensitive data as a server-side programming language –thanks to the Node.js project. Hence, any prototype pollution a...