Prototype Pollution

The application allows a user to pollute the prototype.

Prototype pollution is an attack that allows a malicious user to overwrite the prototype of an object.
To understand prototype pollution, you must first understand prototypal inheritance. Prototypes and the prototype chain is used as a lookup for properties and functions in JavaScript, providing inheritance. When attempting to access a property on a given object, the current object definition is checked. If the current object does not define the property, the prototype class is checked. The prototypes are recursively checked until either the property is found, or there are no more prototypes set.

Because most objects in JavaScript by default have a prototype pointing to Object.prototype, if an attacker can overwrite the prototype of an object, they can typically overwrite the definition of Object.prototype, affecting all objects within the application.

If the application (or any of its dependencies) relies on the fact that properties can be undefined rather than always being explicitly set, then if the prototype has been polluted, the application might inadvertently read from the prototype instead of the intended object.

Prototype pollution occur can when:

1. Data enters a program from an untrusted source.



2. The data is passed to an API that allows overwriting the prototype.

Example 1: The following code uses a vulnerable version of lodash to pollute the prototype of the object:

import * as lodash from 'lodash'
...
let clonedObject = lodash.merge({}, JSON.parse(untrustedInput));
...

At this point, if the untrusted input is {"__proto__": { "isAdmin": true}}, then Object.prototype will have defined isAdmin = true.

Consider the following code that exists later in the application.

...
let config = {}
if (isAuthorizedAsAdmin()){
    config.isAdmin = true;
}
...
if (config.isAdmin) {
    // do something as the admin
}
...

Even though isAdmin should only be set to true if isAuthorizedAdmin() returns true, because the application fails to set config.isAdmin = false in the else condition, it relies upon the fact that config.isAdmin === undefined === false.
Unfortunately, as the prototype has been polluted, the prototype of config has now set isAdmin === true, which allows the administrator authorization to be bypassed.