Listen to this Post
Introduction:
Prototype pollution is a critical JavaScript vulnerability that exploits the inheritance mechanism of objects, allowing attackers to inject properties into the global Object prototype. This contamination can lead to a range of exploits, from Cross-Site Scripting (XSS) to Remote Code Execution (RCE), often flying under the radar of traditional security scanners. Understanding its mechanics is paramount for modern web application security.
Learning Objectives:
- Understand the core mechanics and prerequisites for a prototype pollution attack.
- Learn to identify unsafe recursive merge functions and other vulnerable code patterns.
- Acquire practical skills to exploit and, more importantly, mitigate prototype pollution vulnerabilities.
You Should Know:
1. The Anatomy of an Unsafe Merge
The heart of prototype pollution often lies in an insecure recursive merge function that fails to sanitize keys like `__proto__` or constructor.prototype.
function isObject(item) {
return item && typeof item === 'object' && !Array.isArray(item);
}
function unsafeMerge(target, source) {
for (const key in source) {
if (isObject(target[bash]) && isObject(source[bash])) {
unsafeMerge(target[bash], source[bash]);
} else {
target[bash] = source[bash];
}
}
return target;
}
Step-by-step guide: This function recursively copies properties from a `source` object to a `target` object. If an attacker-controlled object contains a key like __proto__, the function will traverse up the prototype chain and assign the value to Object.prototype. This pollutes every object in the application, as they inherit from this base prototype. To test, pass `{“__proto__”:{“polluted”:”true”}}` to this function and then check if `({}).polluted` returns "true".
2. Identifying the Sink: From Pollution to Exploitation
Pollution alone is useless without a “sink”—a function that uses the polluted property to execute code.
// Example Sink: Unsafe Dynamic Code Evaluation
let config = {};
let userInput = config.trustedDomain;
// If Object.prototype.trustedDomain is polluted, this can be exploited.
eval('window.location = "' + userInput + '"');
Step-by-step guide: After successfully polluting the prototype (e.g., setting `Object.prototype.trustedDomain` to "x";alert(1)//), the application logic that uses `config.trustedDomain` will pass the malicious string to eval(). This executes the attacker’s JavaScript, leading to an XSS attack. The key is to trace polluted properties to functions like eval(), setTimeout(), innerHTML, or document.write().
3. Exploitation via PostMessage
The `postMessage` API is a common vector for delivering prototype pollution payloads across domains.
// Vulnerable Event Listener
window.addEventListener('message', (event) => {
const data = JSON.parse(event.data);
unsafeMerge(applicationSettings, data);
});
Step-by-step guide: An attacker hosting a malicious site can use `window.opener.postMessage()` to send a message to the vulnerable application. The payload would be a JSON string like '{"__proto__":{"injectedProperty":"injectedValue"}}'. The `JSON.parse` call creates the malicious object, and `unsafeMerge` propagates the property to the prototype, achieving pollution.
4. Server-Side Prototype Pollution (SS-PP)
Prototype pollution is not confined to the client. Node.js applications are also vulnerable, potentially leading to RCE.
// Example: Polluting to modify environment variables
const maliciousPayload = '{"<strong>proto</strong>":{"NODE_OPTIONS":"--inspect=0.0.0.0:1337"}}';
// If a vulnerable application merges this, it could open a debug port.
Step-by-step guide: In a Node.js context, an attacker can send a payload that pollutes global object prototypes. By polluting properties like `NODE_OPTIONS` or by manipulating template engines (e.g., Handlebars), an attacker can achieve Remote Code Execution. This is often exploited via unsanitized input in HTTP parameters or request bodies to API endpoints.
5. Manual Detection with Browser DevTools
Security researchers can manually test for prototype pollution using the browser’s developer console.
// Step 1: Check for existing pollution
console.log(({}).polluted);
// Step 2: Attempt to pollute via URL parameter (if app uses vulnerable lib)
// Navigate to: https://vulnerable-site.com/page?__proto__[bash]=test
// Step 3: Check again
console.log(({}).polluted); // If 'test', vulnerability exists.
Step-by-step guide: This is a fundamental manual testing technique. After interacting with the application (e.g., submitting forms, changing URL parameters), you check the global object for injected properties. This method is effective for finding client-side pollution vulnerabilities that automated tools might miss.
6. Mitigation: Safe Object Assignment
The most robust mitigation is to avoid unsafe recursive merges and use immutable patterns or safe libraries.
// Safe approach using Object.assign for shallow merge
const safeMerge = (target, ...sources) => {
return Object.assign(target, ...sources);
};
// Deep clone using a safe library or structuredClone
const trulySafeDeepClone = (obj) => {
return JSON.parse(JSON.stringify(obj));
};
Step-by-step guide: `Object.assign` performs a shallow merge and does not recursively traverse prototype properties. For deep clones, `JSON.parse(JSON.stringify(obj))` is a quick, safe method for JSON-serializable objects, as it completely bypasses prototypes. For more complex needs, use vetted libraries like Lodash’s `_.cloneDeep` with security patches.
7. Advanced Mitigation: Prototype Freezing
For critical applications, making the global prototype immutable can be a last line of defense.
// Prevent any modifications to Object.prototype Object.freeze(Object.prototype); // Prevent extensions on other built-in prototypes Object.preventExtensions(Array.prototype); Object.preventExtensions(Function.prototype);
Step-by-step guide: The `Object.freeze()` method makes an object immutable. No properties can be added, modified, or removed. Applying this to `Object.prototype` effectively neuters most prototype pollution attacks. This should be done at the very start of your application’s lifecycle, but it may break libraries that rely on prototype monkey-patching.
What Undercode Say:
- Prevention Over Detection: The ephemeral nature of client-side pollution makes it difficult to log and detect. Building applications with safe coding patterns from the outset is more effective than trying to find and patch every instance later.
- The Expansion of Attack Surfaces: As noted by security researchers, Server-Side Prototype Pollution (SS-PP) significantly raises the stakes, transforming a client-side nuisance into a direct path to system compromise. The conflation of client-side and server-side JavaScript ecosystems means a single vulnerable library can expose both ends of an application.
The analysis suggests that prototype pollution acts as a “force multiplier” for other vulnerabilities. A seemingly minor flaw in an object-merging utility can elevate a simple input sanitization bypass into a full-scale RCE incident. As modern applications rely more on complex client-side frameworks and shared JavaScript libraries, the potential for these subtle yet powerful attacks will only grow. The security community’s focus must shift towards secure-by-default designs in JavaScript frameworks and comprehensive software composition analysis to manage this risk.
Prediction:
Prototype pollution will evolve from a niche vulnerability to a mainstream attack vector, driven by the increasing complexity of JavaScript applications and the widespread use of vulnerable open-source libraries. We will see a rise in automated exploitation tools, making these attacks accessible to less-skilled threat actors. This will lead to widespread, automated campaigns focusing on data theft and credential harvesting via polluted web properties, forcing a fundamental shift in how JavaScript handles object inheritance and property assignment at the engine level.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: 0xacb Prototype – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
