Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2023-26136

Description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

POC

Reference

- https://github.com/salesforce/tough-cookie/issues/282

- https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873

Github

- https://github.com/AlbertoChar/tough-cookie-demo

- https://github.com/CUCUMBERanOrSNCompany/SealSecurityAssignment

- https://github.com/PuddinCat/GithubRepoSpider

- https://github.com/cfvalenzuela-vidal/safenotes

- https://github.com/dani33339/Tough-Cookie-v2.5.0-Patched

- https://github.com/fkie-cad/nvd-json-data-feeds

- https://github.com/guy2610/tough-cookie-patch-cve-2023-26136

- https://github.com/jasonlin0720/vuln-reporter

- https://github.com/liorlugasi/portfolio

- https://github.com/m-lito13/SealSecurity_Exam

- https://github.com/mathworks/MATLAB-language-server

- https://github.com/morrisel/CVE-2023-26136

- https://github.com/nomi-sec/PoC-in-GitHub

- https://github.com/plzheheplztrying/cve_monitor

- https://github.com/ronmadar/Open-Source-Seal-Security

- https://github.com/seal-community/patches

- https://github.com/shaharduany/tough-cookie-v2.5.0-patch

- https://github.com/trong0dn/eth-todo-list

- https://github.com/uriyahav/tough-cookie-2.5.0-cve-2023-26136-fix