Prototype Pollution

Exploitation

• Vulnerable NodeJS libraries: here

• Access prototype of an object via __proto__ or constructor.prototype property

• Client-side prototype pollution vulnerabilities: here

• Safe Identification: here

  • Status Code: __proto__.status

  • Parameter Limit: __proto__.parameterLimit

  • Content-Type: __proto__.content-type

Attack can be chained with XSS, DoS, etc

Prevention

• Check user-supplied properties against a whitelist

• Freeze prototype by calling Object.freeze()

• Create object without prototype with Object.create(null)