Prototype Pollution is a problem that can affect JavaScript applications. That means both applications running in web browsers, and under Node.js on t

What is a Prototype Pollution vulnerability and how does page-fetch help?

submited by

Style Pass

2021-06-10 15:00:10

Prototype Pollution is a problem that can affect JavaScript applications. That means both applications running in web browsers, and under Node.js on the server-side, but today we’re going to focus on the web side of things.

We’ll also take a look at page-fetch: a new open source tool released by the Detectify Security Research team that can, amongst other things, help you hunt for prototype pollution issues in the wild! Jump to tool.

Before we can talk about Prototype Pollution, we should probably start with what a Prototype is. JavaScript, like many languages, has objects: a set of keys and values grouped together:

Those values can be basic types like numbers or strings, but also functions, arrays, or other objects. It’s pretty common in the world of Object Oriented Programming to want one object to be a “descendant” of another; the descendant inheriting the properties of its parent. Let’s look at an example:

These two objects, webPage and blogPost, have a lot in common. The title and navigation properties are both identical! Wouldn’t it be nice if that data didn’t have to be duplicated? The good news is that JavaScript lets us “connect” one object to another.