Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Prototype pollution occurs when an application takes user-supplied input and uses it to improperly modify the properties of a JavaScript object's prototype. This allows attackers to inject key-value pairs into the base object, potentially altering the application's logic, crashing it, or escalating privileges.
This vulnerability typically arises in JavaScript when functions like `Object.assign()`, `merge()`, or `deepClone()` recursively combine objects without properly validating the source keys. Attackers can send crafted input containing special keys like `__proto__` or `constructor.prototype`. If this input is merged unsafely, the polluted properties are added to the global prototype chain, affecting every object that inherits from it. To prevent prototype pollution, developers should adopt security-focused practices. These include using objects without prototypes (e.g., `Object.create(null)`), employing safe merge functions that reject prototype-related keys, and validating all external input before processing. Freezing the `Object.prototype` in critical environments can also serve as a defensive measure against this type of attack.
Impact: Read Application DataModify Application Data
This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This creates attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of the object prototype (such as hasOwnProperty, toString, or valueOf).
Impact: DoS: Crash, Exit, or Restart
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
Effectiveness: High
Effectiveness: High
Strategy: Input Validation
Effectiveness: Limited
Effectiveness: High
Effectiveness: Moderate
ID : DX-206
This function sets object attributes based on a dot-separated path.Code Example:
javascriptCode Example:
javascriptCode Example:
javascript// Ignore attributes which resolve to object prototype* if (attr === "proto" || attr === "constructor" || attr === "prototype") {
javascript