CVE-2020-7719: 
JavaScript vulnerability analysis and mitigation

Versions of package locutus before 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parse_str function. The vulnerability was discovered and disclosed on August 14, 2020, and was assigned CVE-2020-7719 (NVD, Snyk).

The vulnerability exists in the parse_str function within the php.strings module. When processing user input, the function fails to properly validate object properties, allowing an attacker to manipulate JavaScript language construct prototypes. The vulnerability received a CVSS v3.1 base score of 9.8 (Critical), indicating high impact across confidentiality, integrity, and availability (Snyk).

Successful exploitation of this vulnerability could lead to multiple impacts: denial of service by triggering JavaScript exceptions, tampering with application source code to force attacker-controlled code paths, and potential remote code execution. The vulnerability allows attackers to inject properties into existing JavaScript language construct prototypes, affecting all objects through the prototype chain (Snyk).

A proof of concept exists demonstrating the vulnerability. The exploit can be triggered by passing specially crafted input to the parse_str function that includes prototype-related properties. Example: const phpjs = require('phpjs'); phpjs.parse_str("proto[polluted]=true",{}); console.log(polluted); (GitHub PR).

The vulnerability was fixed in version 2.0.12 of the locutus package. The fix implements input validation to check for prototype keywords (proto, constructor and prototype), where if detected, the function returns the object without modification. Users should upgrade to version 2.0.12 or later to address this vulnerability (GitHub PR).

The vulnerability was responsibly disclosed through the huntr bug bounty program, and the discoverer was awarded $25 for identifying and fixing the vulnerability. The fix was merged into the main repository on September 3, 2020, and version 2.0.12 was promptly released (GitHub PR).