Global Object Prototype Pollution Report - code in article
(() => {
const ArrayOfInterestingObjects = ['google', 'gapi', 'gadgets', 'ga'];
// Malicious payload to test prototype pollution
const maliciousPayload = JSON.parse('{"__proto__": {"polluted": "XSS!"}}');
const pollutionResults = [];
ArrayOfInterestingObjects.forEach((key) => {
const target = window[key];
if (!target) {
console.warn(`window.${key} does not exist.`);
pollutionResults.push({
key,
exists: false,
polluted: false,
reason: 'Object does not exist',
});
return;
}
console.log(`Inspecting window.${key}:`, target);
try {
Object.assign(target, maliciousPayload);
const wasPolluted = {}.polluted === 'XSS!';
pollutionResults.push({
key,
exists: true,
polluted: wasPolluted,
snapshot: JSON.stringify(target, null, 2),
});
console.log(`window.${key} polluted?`, wasPolluted);
} catch (err) {
console.error(`Error while attempting to assign to window.${key}:`, err);
pollutionResults.push({
key,
exists: true,
polluted: false,
reason: `Error during assign: ${err.message}`,
});
}
});
// Open results in a new tab
const win = window.open("", "_blank");
win.document.write(`
<html>
<head>
<title>Global Object Prototype Pollution Test</title>
<style>
body { background: #121212; color: #0ff; font-family: monospace; padding: 20px; }
table { border-collapse: collapse; width: 100%; }
th, td { border: 1px solid #0ff; padding: 5px; vertical-align: top; }
th { background: #1a1a1a; }
td { white-space: pre-wrap; word-break: break-word; }
</style>
</head>
<body>
<h1>Global Object Prototype Pollution Report</h1>
<table>
<thead>
<tr>
<th>Object</th>
<th>Exists</th>
<th>Polluted</th>
<th>Details</th>
</tr>
</thead>
<tbody>
${pollutionResults.map(({ key, exists, polluted, reason, snapshot }) => `
<tr>
<td>${key}</td>
<td>${exists ? 'YES' : 'NO'}</td>
<td>${polluted ? 'YES' : 'NO'}</td>
<td>${exists ? `<pre>${snapshot || reason || '(no details)'}</pre>` : reason}</td>
</tr>
`).join('')}
</tbody>
</table>
<h2>Prototype Check</h2>
<pre>Object.prototype.polluted: ${JSON.stringify({}.polluted || '(not polluted)')}</pre>
</body>
</html>
`);
win.document.close();
})();
Comments
Post a Comment
Please feel free to sign up and join the discussion or start one