id: prototype-pollution-check info: name: Prototype Pollution Check author: pdteam severity: medium reference: - https://github.com/msrkp/PPScan tags: headless headless: - steps: - action: setheader args: part: response key: Content-Security-Policy value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;" - action: setheader args: part: response key: X-Frame-Options value: foo - action: setheader args: part: response key: If-None-Match value: foo - action: script args: hook: true code: | // Hooking code adapted from https://github.com/msrkp/PPScan/blob/main/scripts/content_script.js () => { window.alerts = []; logger = found => window.alerts.push(found); function check() { loc = location.href; if (loc.indexOf("e32a5ec9c99") >= 0 && loc.search("a0def12bce") == -1) { setTimeout(function() { if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60") { logger(location.href); } var url = new URL(location.origin + location.pathname); url.hash = "__proto__[a0def12bce]=ddcb362f1d60&__proto__.a0def12bce=ddcb362f1d60&dummy"; location = url.href; }, 5 * 1000); } else if (loc.search("a0def12bce") != -1) { setTimeout(function() { if (Object.prototype.a0def12bce == "ddcb362f1d60") { logger(location.href); } window.close(); }, 5 * 1000); } else { var url = new URL(loc); url.searchParams.append("__proto__[e32a5ec9c99]", "ddcb362f1d60"); url.searchParams.append("__proto__.e32a5ec9c99", "ddcb362f1d60"); location = url.href; } } window.onload = function() { if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60" || Object.prototype.a0def12bce == "ddcb362f1d60") { logger(location.href); } else { check(); } }; var timerID = setInterval(function() { if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60" || Object.prototype.a0def12bce == "ddcb362f1d60") { logger(location.href); clearInterval(timerID); } }, 5 * 1000); } - args: url: "{{BaseURL}}" action: navigate - action: waitload - action: script name: alerts args: code: | () => { window.alerts } matchers: - type: word part: alerts words: - "__proto__" extractors: - type: kval part: alerts kval: - alerts