Prototype Pollution Lab: Become Admin Without an Admin Flag

This article explains prototype pollution, a JavaScript-specific vulnerability where unguarded merge functions allow attackers to write properties onto Object.prototype, affecting every object in an application. The lab demonstrates the attack through ProfileApp, where a user without admin privileges can become admin by polluting the prototype to set isAdmin to true. The attack works because JavaScript property lookups walk up the prototype chain, making this a critical class of bug affecting both client-side and server-side code.

• How prototype pollution exploits the property lookup chainJavaScript resolves properties by checking the object first, then its prototype, then Object.prototype. In the lab, the user object has no isAdmin property, so the admin check would normally return undefined. By polluting Object.prototype with isAdmin: true through an unguarded merge, every object in the app—including the attacker's—now inherits that property, causing the check to pass.
• The unguarded recursive merge vulnerabilityProfileApp's merge function copies JSON settings into the user object recursively without filtering dangerous key names. When the settings contain a nested __proto__ key, the merge function follows it directly onto Object.prototype instead of onto the attacker's own object, bypassing the intended isolation of user data.
• Attack payload and execution mechanismThe attacker submits settings as nested JSON with a structure containing __proto__ and a nested isAdmin: true property. The recursive merge processes this structure and writes isAdmin onto Object.prototype rather than the attacker's record. When the admin view checks user.isAdmin, it finds the property through prototype inheritance rather than on the user's own object.
• Real-world impact and documented vulnerabilitiesPrototype pollution has affected major libraries including Lodash (CVE-2019-10744), jQuery, and minimist. On client-side code it can lead to DOM XSS; on Node.js servers it can corrupt application logic, bypass security checks, enable denial of service, or facilitate further attacks.
• Defensive strategy: key filtering and alternative structuresDefense requires rejecting the special keys __proto__, constructor, and prototype in any merge or deep-copy of untrusted input. Additional protections include creating lookup objects with Object.create(null) to eliminate prototype inheritance, using Map instead of plain objects for user-driven key/value data, and keeping merge libraries patched with versions hardened against this vulnerability.
• Why __proto__ and constructor keys are dangerousThe article identifies __proto__, constructor, and prototype as dangerous keys because they directly reference or modify an object's prototype chain. If a merge function copies these keys literally from user input without filtering, it allows attackers to write arbitrary properties onto Object.prototype or manipulate the constructor chain.

Bottom line: Prototype pollution occurs when recursive merge or copy functions fail to filter the special keys __proto__, constructor, and prototype, allowing attackers to modify Object.prototype and inject properties inherited by all objects in the application. Defending against it requires explicit key filtering, using Object.create(null) or Map for user-controlled data, and maintaining patched versions of merge libraries.