prototype-pollution

Prototype pollution occurs when attacker-controlled keys are merged into nested objects and pollute Object.prototype or constructor.prototype. This vulnerability typically arises in web and API endpoints that parse query strings or JSON bodies, as well as client-side routers that merge URL fragment data.

Detect client-side prototype pollution by injecting __proto__ and constructor.prototype path variations into URL fragments. Observe global-side effects in subsequent requests to determine if the client-side router merges fragment data into objects and allows prototype manipulation.

Verify prototype pollution persistence by sending JSON body or parsed query payloads to the target, then issuing a clean follow-up request. If the clean request exhibits observable side effects, the black-box detection confirms that the prototype pollution successfully persisted globally.

Yes, after confirming prototype pollution, you can map likely post-pollution sinks to identify gadget-driven exploitation scenarios. This includes prioritizing template and configuration-driven RCE paths where untrusted keys are used to configure libraries via object merging or deep assignment.

Prioritize checking for object merging vulnerabilities when user inputs are merged into nested objects, deep assigned, or used to configure libraries via untrusted keys. Use a decision tree for triage to identify merge-sink scenarios that are highly susceptible to prototype pollution.