JavaScript Prototype Chain Manipulation

Detects patterns that allow direct manipulation of the JavaScript prototype chain, enabling prototype pollution and security bypass.

zakirkun dbcc977 2 files · 2.5 KB Updated

File contents

JavaScript Prototype Chain Manipulation

Overview

Beyond basic __proto__ assignment, prototype chain attacks include:

  • Setting properties on Object.prototype via indirect paths
  • Using constructor.prototype to poison objects
  • Object.setPrototypeOf() with attacker-controlled objects
  • Vulnerable deserialization that constructs objects on attacker-defined chains

Remediation

  • Freeze base object prototypes in security-sensitive code: Object.freeze(Object.prototype)
  • Use Object.create(null) for pure hash maps
  • Validate all keys before property assignment

zakirkun/ice-tea/tree/main/skills/injection/js-prototype-chain commit dbcc977a5d

Frequently asked questions

npx skillmds@latest add zakirkun/javascript-prototype-chain-manipulation