cbcvebase.
CVE-2019-11358
published 2019-04-20

CVE-2019-11358: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…

PriorityP278medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
87.22%
99.7th percentile
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Affected

247 ranges· showing 25
VendorProductVersion rangeFixed in
backdropcmsbackdrop>= 1.11.0 < 1.11.91.11.9
backdropcmsbackdrop>= 1.12.0 < 1.12.61.12.6
debiandebian_linux
debiandebian_linux
debiandebian_linux
debianmediawiki< mediawiki 1:1.31.2-1 (bookworm)mediawiki 1:1.31.2-1 (bookworm)
debiannode-jquery< mediawiki 1:1.31.2-1 (bookworm)mediawiki 1:1.31.2-1 (bookworm)
debianotrs2< mediawiki 1:1.31.2-1 (bookworm)mediawiki 1:1.31.2-1 (bookworm)
djangoprojectdjango>= 2.0a1 < 2.1.92.1.9
djangoprojectdjango>= 2.2a1 < 2.2.22.2.2
drupalcore>= 8.0.0 < 8.5.158.5.15
drupalcore>= 8.6.0 < 8.6.158.6.15
drupaldrupal>= 7.0 < 7.667.66
drupaldrupal>= 8.5.0 < 8.5.158.5.15
drupaldrupal>= 8.6.0 < 8.6.158.6.15
drupaldrupal_core
ezsystemsezplatform-admin-ui-assets>= 4.0.0 < 4.2.04.2.0
fedoraprojectfedora
fedoraprojectfedora
fedoraprojectfedora
joomlajoomla_!3.0.0 – 3.9.4
jqueryjquery< 3.4.03.4.0
jqueryjquery>= 0 < 1.7.2+dfsg-2ubuntu1+esm11.7.2+dfsg-2ubuntu1+esm1
jqueryjquery>= 0 < 1.11.3+dfsg-4ubuntu0.1~esm11.11.3+dfsg-4ubuntu0.1~esm1
jqueryjquery>= 0 < 3.2.1-1ubuntu0.1~esm13.2.1-1ubuntu0.1~esm1

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://code.jquery.com/jquery-3.3.1.min.js
command$.extend(true, {}, {"__proto__": {"backLink": "<img src=x onerror=alert('XSS')>"}})
  • Detect prototype pollution attempts by monitoring for HTTP request parameters or JSON payloads containing the literal key '__proto__', which is the attack vector for CVE-2019-11358 via jQuery.extend(true, {}, ...).
  • Flag or block any JSON body or query string containing '__proto__' as a key, as this is the specific payload pattern exploiting jQuery.extend deep merge behavior.
  • Identify vulnerable jQuery versions (before 3.4.0) loaded on pages; specifically jQuery 3.3.1 is confirmed exploitable and used in published PoC exploit code.
  • For Drupal deployments, check for Drupal core versions below 8.6.15, 8.5.15, or 7.66 which bundle vulnerable jQuery (3.2.1 for Drupal 8, 1.4.4 for Drupal 7).
  • Monitor DOM manipulation calls such as $('#...').html(...) receiving values derived from polluted Object.prototype properties, which is the final XSS delivery step in this exploit chain.
  • ·The vulnerability only triggers when jQuery.extend is called in deep-merge mode (first argument is boolean true). Shallow merges are not affected.
  • ·Drupal's fix backports the jQuery.extend() patch without upgrading the bundled jQuery version itself, so the jQuery version string alone cannot be used to confirm patched status on Drupal sites.
  • ·Exploitability depends on whether a Drupal module or application passes unsanitized user-controlled data into jQuery.extend; not all jQuery deployments are automatically exploitable.

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vulncheck6.1MEDIUM
vendor_oracle9.8MEDIUM
vendor_debian6.1MEDIUM
vendor_msrc6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.