Prototype Pollution

Also Known As

TL;DR

Explanation

Prototype pollution is a JavaScript-specific vulnerability where user-controlled keys like __proto__ or constructor.prototype are used to write properties onto Object.prototype. Because all JavaScript objects inherit from Object.prototype, injected properties propagate globally and can override application logic, bypass security checks, or escalate to remote code execution in server-side Node.js contexts. PHP is not affected, but PHP applications serving JavaScript-heavy frontends should sanitise JSON inputs and use libraries with known mitigations.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Deep-merging objects using recursive assignment without checking for __proto__ or constructor keys.
• Using user-supplied strings as keys in object assignment — an attacker sends __proto__[isAdmin]=true.
• Not using Object.create(null) for dictionaries/maps that accept user-controlled keys.
• Ignoring prototype pollution in server-side Node.js — it's not only a browser problem.

Code Examples

// JavaScript — merging user object pollutes Object.prototype
function merge(target, source) {
    for (let key in source) {
        target[key] = source[key]; // key could be '__proto__'
    }
}
merge({}, JSON.parse('{"__proto__":{"admin":true}}'));
console.log({}.admin); // true — every new object is now 'admin'

// Use Object.keys() — own keys only, no prototype chain
function safeMerge(target, source) {
    for (let key of Object.keys(source)) {
        if (['__proto__','constructor','prototype'].includes(key)) continue;
        target[key] = source[key];
    }
}

// Or use Object.create(null) — no prototype at all
const safe = Object.create(null);

// Or JSON round-trip for deep clone of untrusted data:
const clone = JSON.parse(JSON.stringify(untrusted));

// PHP note: not applicable — PHP objects don't share a mutable prototype

References

• ↗ https://portswigger.net/web-security/prototype-pollution
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

Tags

Related Terms