exploiting-prototype-pollution-in-javascript

name	exploiting-prototype-pollution-in-javascript
description	Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
domain	cybersecurity
subdomain	web-application-security
tags	["prototype-pollution","javascript","node-js","xss","rce","property-injection","dom-xss","server-side-pollution"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Exploiting Prototype Pollution in JavaScript

When to Use

• When testing Node.js or JavaScript-heavy web applications
• During assessment of APIs accepting deep-merged JSON objects
• When testing client-side JavaScript frameworks for DOM XSS via prototype pollution
• During code review of object merge/clone/extend operations
• When evaluating npm packages for prototype pollution gadgets

How to CONFIRM a Hit (avoid false negatives)

• The positive signal is a polluted property surviving on the prototype, then a gadget firing. Client-side: after the payload, ({}).polluted (or Object.prototype.polluted) returns your value in the console. Server-side: a property you injected changes server behaviour you can observe.
• Server-side confirmation without source: pollute a property the framework reflects — e.g. {"__proto__":{"status":510}} and watch for an HTTP 510 response, or {"__proto__":{"json spaces":10}} (Express) causing reformatted/whitespaced JSON, or a content-type/charset change. A normal 200 is NOT proof; require an attributable behaviour delta.
• Two-stage proof: (1) show pollution lands, (2) show a gadget consumes it (DOM-XSS sink, RCE via template/child_process, or auth flag like isAdmin). Pollution without a reached sink is still a finding but verify stage 1 first.
• Do NOT conclude negative until you have tried ALL of these vectors and contexts:
  • Key syntaxes: __proto__[x]=1, __proto__.x=1, constructor[prototype][x]=1, constructor.prototype.x=1.
  • Sources: URL query, hash fragment, JSON body (deep-merge endpoints), postMessage, and form params.
  • Both client-side (DOM Invader gadget scan) and server-side (status/JSON-format reflection) — one being clean does not clear the other.
  • Nested/recursive merge endpoints specifically (clone/extend/merge/defaultsDeep).
• Reset state between probes: a stale polluted prototype from a prior payload can cause false positives — reload/clear before each confirmation.

Prerequisites

• Burp Suite with DOM Invader extension for client-side prototype pollution detection
• Node.js development environment for server-side testing
• Understanding of JavaScript prototype chain and object inheritance
• Knowledge of common pollution gadgets (sources, sinks, and exploitable properties)