External Control Vulnerability in Pomelo by NetEase

CVE-2019-18954

What is CVE-2019-18954?

The Pomelo framework version 2.2.5 is susceptible to a security vulnerability that permits external manipulation of critical internal state data. This issue arises when untrusted user input is processed, allowing an attacker to overwrite internal attributes and methods defined in the 'entryHandler.js' file. By using conflicting names in the user input, an attacker can craft specific inputs to alter the behavior of the system and potentially gain unauthorized access or disrupt normal operations. This vulnerability highlights the importance of stringent input validation and sanitization to protect against such injection attacks.

References