Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-26136
CVE-2023-26136:
JavaScript vulnerability analysis and mitigation
Overview
CVE-2023-26136 affects the tough-cookie package versions before 4.1.3. The vulnerability is related to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. The vulnerability was discovered by Kokorin Vsevolod and was disclosed on June 8, 2023 (Snyk Advisory).
Technical details
The vulnerability is classified as a Prototype Pollution issue (CWE-1321) with a CVSS v3.1 base score of 9.8 (CRITICAL) according to NVD, though Snyk rates it at 6.5 (MEDIUM). The vulnerability occurs when using CookieJar with rejectPublicSuffixes=false mode, where an attacker can manipulate cookie domains to pollute JavaScript object prototypes. The issue stems from the initialization of objects using {} instead of Object.create(null), allowing for prototype chain manipulation (GitHub Issue).
Impact
When successfully exploited, this vulnerability can lead to disclosure of sensitive information and modification of data through prototype pollution. An attacker can expose or modify property information on affected objects, potentially leading to security implications in applications using the vulnerable package. The vulnerability does not impact system availability (Snyk Advisory).
Mitigation and workarounds
The vulnerability has been fixed in tough-cookie version 4.1.3. The fix involves changing all occurrences of new object creation in memstore.js from {} to Object.create(null) to prevent prototype pollution. Users should upgrade to version 4.1.3 or higher to address this vulnerability (GitHub Commit, GitHub Release).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management