Prototype Pollution (JS-style)
web · medium · +40 XP
// what is Prototype Pollution (JS-style)?
Prototype Pollution (JS-specific class of injection) — a naïve deep-merge / Object.assign({}, user_input) walks __proto__ and constructor.prototype, mutating the shared prototype that every other object inherits from. Set Object.prototype.is_admin = true and suddenly every object reads is_admin === true until restart.
// how attackers detect it
- [01]POST
{"__proto__":{"polluted":true}}to any deep-merge endpoint. Then check if({}).polluted === true. - [02]Tools:
ppmap,pollution-finder, snyk's prototype-pollution-finder. Or static-grep forObject.assign,_.merge,lodash.set. - [03]Server-side Node? Try
__proto__.toStringinjection → can crash or alter every JSON.stringify.
// how defenders prevent it
- ✓
Object.create(null)for user-supplied containers — no prototype, no pollution. - ✓Sanitise
__proto__,constructor,prototypekeys before merge.JSON.parsewith a reviver works. - ✓Use structured cloning or schema-validated parsers (zod, ajv) instead of recursive deep-merge.
// real-world incidents
CVE-2019-10744
Lodash prototype pollution
100M+ downloads/month at the time — wide blast radius.
CVE-2022-22963
Spring Cloud Function (RCE)
SpEL injection chained from similar root cause.
// hands-on tips for this lab
- ›Send
{"__proto__":{"is_admin":true}}to/merge, thenGET /mereturnsis_admin:true+ the flag.
was this lesson helpful?
8 of 10 · web