Cyber ·
Prototype pollution in Tampermonkey: a modest flaw that needs interaction
Report on prototype pollution in Tampermonkey, a userscript manager, through the internationalized antifeature tag. According to the text, the flaw can replace script code, but it requires user interaction or impractical circumstances.
A report published as a machine translation of a security blog describes a prototype pollution flaw in Tampermonkey, a userscript manager used in browsers. The antifeature tag, which signals monetization in scripts, supports internationalization and is stored as a nested object in which type and locale are keys. A manipulated locale can alter prototype properties and, under certain conditions, replace script code.
The author tried to use the flaw to install scripts without user confirmation, which would have had high impact. The locale normalization function strips camelCase and snake_case names, which limits the available gadgets. The key that controls confirmation could not be overwritten through the prototype, because the options object is spread after the default values. For this reason, the text rates the flaw as modest.
The material matters to teams that depend on userscripts in corporate browsers, since scripts installed from external links can load unwanted code. To verify the original, search for the title on the tmctmt blog, confirm the publication date, and compare with the extension maker's advisory and the installed version. Rota Nacional does not offer a fix or protection for this flaw, and this text does not describe any platform feature that resolves it.
Original source: Uma (um tanto modesta) poluição de protótipo no Tampermonkey