Intro
Prototype Pollution is a vulnerability that allows attackers to exploit the rules of the JavaScript programming language, by injecting properties into existing JavaScript language construct prototypes, such as Objects to compromise applications in various ways.
JavaScript allows all Object attributes to be altered. This includes their magical attributes such as __proto__, constructor and prototype.
An attacker is able to manipulate these attributes to overwrite, or pollute a JavaScript application object prototype of the base object, by injecting other values.
Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain, resulting in either:
- Denial of Service – by triggering JavaScript exceptions
- Remote Code Execution – by tampering with the application source code to force the code path that the attacker injects
- XSS – see examples below
Why is Prototype Pollution an issue?
In Javascript, prototypes define an object’s structure and properties, so that the application knows how to deal with the data. When new objects are created, they carry over the properties and methods of the prototype “object”. If you modify the prototype in one place, it will affect how the objects work throughout an entire application.
What you need to verify a Prototype Pollution
If you have a Firefox or Chrome browser installed, you should be good to go! In this blog, I will be using Firefox.
Simply open the Firefox Developer Tools from the menu by selecting Tools -> Web Developer -> Toggle Tools or use the keyboard shortcut Ctrl + Shift + I or F12 on Windows and Linux, or Cmd + Opt + I on macOS.
What is susceptible to Prototype Pollution manipulation?
The impact and severity of Prototype Pollution depends on the application. Property definition by path/location is a key example.
Property definition by path/location
There are numerous JavaScript libraries which are vulnerable to Prototype Pollution due to document.location. Finding out which are vulnerable is easy. GitHub user BlackFan maintains a list of libraries that are vulnerable to Prototype Pollution due to document.location. You can find this list here. An example of a high severity prototype pollution security vulnerability was discovered in the lodash library (versions less than 4.17.15).
Let’s dissect the JavaScript objects to better understand what is happening.
First, we will create an object and access its attributes.
For example, if we create object Book as:var book = {bookName: "Book name", authorName: "Author of book"};
We can access the name and the author using two different notations, the dot notation (e.g.: book.name), and the square bracket notation (e.g.: book[“name”]).
book.bookName | //output: “Book name” |
book["bookName"] | //output: “Book name” |
var name = "bookName"; | |
Book[name] | //output: “Book name” |
book.authorName | //output: “Author of book” |
book["authorName"] | //output: “Author of book” |
var author = "authorName"; | |
book[author] | //output: “Author of book” |
The object Object has a few properties for its prototype. We are interested in “constructor“ and “__proto__“.
You can see all available properties of the Object by typing Object.prototype. in the console of a web browser by opening developer tools.
Now that you know how to access these attributes and list them, how can you use this to add something and pollute the Object?
Let’s create an object book and try to access some non-existent values?var book = {bookName: "Book name", authorName: "Author of book"};book.constructor.protoSomeRandomName // this will not work, since there is no attribute protoSomeRandomName
but what if we do thisObject.__proto__["protoSomeRandomName"]="protoSomeRandomValue"book.constructor.protoSomeRandomName // this will work and return value protoSomeRandomValue (is it magic? not really)
We proved this indeed polluted all the objects created from the object Object with the new attribute, and all of these new objects have inherited this attribute from the prototype.
Simple Example Prototype Pollution payloads
Object.__proto__["protoSomeRandomName"]="protoSomeRandomValue"Object.__proto__.protoSomeRandomName="protoSomeRandomValue"Object.constructor.prototype.protoSomeRandomName="protoSomeRandomValue"Object.constructor["prototype"]["protoSomeRandomName"]="protoSomeRandomValue"
Polluting the DOM
Examples for vulnerable document.location parsers
Credits go to: s1r1us
https://msrkp.github.io/pp/1.html?__proto__[protoSomeRandomName]=protoSomeRandomValue
https://msrkp.github.io/pp/2.html?__proto__[protoSomeRandomName]=protoSomeRandomValue
https://msrkp.github.io/pp/3.html?__proto__[protoSomeRandomName]=protoSomeRandomValue
XSS examples
XSS example #1 https://msrkp.github.io
XSS example #2 https://msrkp.github.io
How to popup an alert by altering __proto__?
var book = {bookName: "Book name", authorName: "Author of book"};console.log(book.toString())
//output: “[object Object]”book.__proto__.toString = ()=>{alert("polluted")}console.log(book.toString())
Remediating this vulnerability:
This vulnerability can be fixed by:
- Freezing the prototype
Object.freeze(Object.prototype);Object.freeze(Object);
- Schema validation of JSON input
- Avoid using unsafe recursive merge functions
- Using Map instead of Object
- Use Prototypeless Object
var obj = Object.create(null);obj.__proto__ //output undefinedobj.constructor //output undefined
Bright enables developers and security teams to automatically detect Prototype Pollution vulnerabilities, seamlessly integrated across your pipelines, with no-false positives and built with a Dev first approach.
Request a demo now or give it a try today with a FREE account!
