prototype-pollution

Prototype Pollution Detection

Overview

Prototype pollution is a JavaScript flaw in which an attacker adds or overwrites a property on a shared object prototype — nearly always the base object prototype every plain object inherits from — so that objects which never defined that property silently appear to have it. It sits wherever request data is parsed into an object and then recursively merged, cloned, or written by key path into an existing object: the key __proto__, or a constructor then prototype step, redirects the write from the target onto the prototype. The attacker is anyone who controls such input — a query string, a fragment, a request body, a stored configuration blob. Pollution alone is usually inert; it becomes a vulnerability when some later code reads a property it expects to be absent or defaulted, which is the gadget. In a browser that typically produces script execution in the victim's page; in a server process the polluted value persists for the life of the process and can flip an authorization flag every request afterwards or supply option fields to a child-process call. This skill finds such flaws by locating every source, unsafe write, and reachable gadget, checking each site in parallel, and merging the results into <output_dir>/prototype-pollution-results.md.

What it is NOT

• Ordinary DOM-based scripting (/websec:dom-based): if input flows directly from a browser source into a sink, that is regular DOM scripting. Test: is the value at the sink controllable because it is inherited rather than set as an own property? Only then is it this class.
• Reflected or stored scripting (/websec:xss): server-rendered or stored payloads reaching HTML output belong there. Here the payload arrives through the prototype chain of a configuration or options object.
• Mass assignment and parameter binding (/websec:api): setting an own property on the target object — binding isAdmin straight onto a record — is mass assignment. Pollution writes to the shared prototype and only matters when the target lacks its own property.
• Insecure deserialization (/websec:deserialization): both let input reshape objects, but this class involves no serialized object graph, no class instantiation from the input, and no lifecycle hooks. Test: is there a native object reader in the path?
• Access control (/websec:access-control): a server-side gadget that grants privilege is reported here as pollution; note the missing server-side re-derivation of role for that skill.
• Command injection (/websec:os-command-injection): a handler that concatenates input into a shell string belongs there. Here the command arguments or options arrive as inherited fields of an options object the developer left partly undefined.
• Not a finding: an unsafe merge with no reachable gadget — the ability to set a prototype property that nothing ever reads unsafely is a hardening gap, not an exploitable flaw, and should be recorded as such with its reachability stated; map-like data built with a null-prototype object or a real map, where a __proto__ key is inert; a merge whose inputs are entirely server-generated; a dependency listed as vulnerable but never fed user-controllable objects.