prototype-pollution

A security-testing playbook for finding and exploiting prototype pollution in JavaScript stacks, both client and server side. It becomes relevant whenever untrusted input is merged into objects — query-string parsers, JSON bodies, deep assign or deep merge helpers, GraphQL variables, or YAML converted to JSON — and it prioritizes cases that use libraries such as lodash.merge, deep-extend, hoek.applyToDefaults, or qs.

The document explains the mechanism: because property lookups walk the prototype chain up to Object.prototype, a merge that treats a literal __proto__ or constructor.prototype key as a path can attach attacker-controlled properties to the shared prototype, so unrelated later code reads them as if legitimate. It stresses testing both the __proto__ and constructor.prototype paths, since filtering and parser differences make them non-equivalent.

Detection is split into client-side probes (URL-fragment payloads like #__proto__[polluted]=1, DOM and attribute injection ideas, and console verification that a test key persists on Object.prototype) and black-box server-side probes. The server section provides a table of side-effect payloads — polluting qs settings like parameterLimit, ignoreQueryPrefix, and allowDots, or Express behaviors such as 'json spaces', exposedHeaders, and status — and advises sending a pollution request followed by a clean request to observe global persistence. An exploitation section catalogs gadget chains: EJS template options leading to RCE via child_process, the historical Timelion CVE-2019-7609 expression chain, polluting spawn/fork option objects like shell, argv0, env, and NODE_OPTIONS, and using the constructor path to bypass weak __proto__-only filters. It lists research tooling (pp-finder, silent-spring, PPScan, and others) and closes with a decision tree, while cautioning that automated testing can cause side effects and should target only authorized systems.