id: prototype-pollution-check

info:
  name: Prototype Pollution Check
  author: pdteam
  severity: medium
  reference:
    - https://github.com/msrkp/PPScan
  tags: headless

headless:
  - steps:
      - action: setheader
        args:
          part: response
          key: Content-Security-Policy
          value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
      - action: setheader
        args:
          part: response
          key: X-Frame-Options
          value: foo
      - action: setheader
        args:
          part: response
          key: If-None-Match
          value: foo
      - action: script
        args:
          hook: true
          code: |
            // Hooking code adapted from https://github.com/msrkp/PPScan/blob/main/scripts/content_script.js
            (function() {window.alerts = [];

            function logger(found) {
            	window.alerts.push(found);
            }

            function check() {
                loc = location.href;

                if (loc.indexOf("e32a5ec9c99") >= 0 && loc.search("a0def12bce") == -1) {
                    setTimeout(function() {
                        if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60") {
                            logger(location.href);
                        }
                        var url = new URL(location.origin + location.pathname);
                        url.hash = "__proto__[a0def12bce]=ddcb362f1d60&__proto__.a0def12bce=ddcb362f1d60&dummy";
                        location = url.href;
                    }, 5 * 1000);
                } else if (loc.search("a0def12bce") != -1) {
                    setTimeout(function() {
                        if (Object.prototype.a0def12bce == "ddcb362f1d60") {
                            logger(location.href);
                        }
                        window.close();
                    }, 5 * 1000);
                } else {
                    var url = new URL(loc);
                    url.searchParams.append("__proto__[e32a5ec9c99]", "ddcb362f1d60");
                    url.searchParams.append("__proto__.e32a5ec9c99", "ddcb362f1d60");
                    location = url.href;
                }
            }

            window.onload = function() {
                if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60" ||  Object.prototype.a0def12bce == "ddcb362f1d60") {
                    logger(location.href);
                } else {
                    check();
                }
            };

            var timerID = setInterval(function() {
                if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60" || Object.prototype.a0def12bce == "ddcb362f1d60") {
                    logger(location.href);
                    clearInterval(timerID);
                }
            }, 5 * 1000)})();
      - args:
          url: "{{BaseURL}}"
        action: navigate
      - action: waitload
      - action: script
        name: alerts
        args:
          code: "window.alerts"
    matchers:
      - type: word
        part: alerts
        words:
          - "__proto__"
    extractors:
      - type: kval
        part: alerts
        kval:
          - alerts