Clearing , Shifting and Pop Value from Frozen Array

Disclosed: 2017-08-30 13:20:50 By an0n-j To shopify-scripts
None
Vulnerability Details
Hey again! Founded another missing best practice in mruby. That allow an attacker to Delete (pop) or clear the ___Frozen ARRAY___. This report is similar to [194866](https://hackerone.com/reports/194866) POC === $a = [1,2,3,4,5].freeze $a.pop >"#=> This will give 5 and ___$a___ will become [1,2,3,4]" $a.shift > "#=> This will give 1 and ___$a___ will become [2,3,4,5]" $a.clear > "#=> This will clear the whole FROZEN ARRAY." Explanation ======== The issue is in __mrb_ary_pop__ , __mrb_ary_shift__ & in __mrb_ary_clear__ methods of [Array.c](https://github.com/mruby/mruby/blob/master/src/array.c) because there is no method calling to check the weather the Array is frozen or not. I'm not too much familiar with ruby to determine its impact, may be it doesn't effect at all but it should be fix. Fix == Apply __ary_modify__ method in all above mentioned methods.
Actions
View on HackerOne
Report Stats
  • Report ID: 196416
  • State: Closed
  • Substate: resolved
  • Upvotes: 12
Share this report