Prototype Pollution Leads to RCE: Gadgets Everywhere

Many have heard about Prototype Pollution vulnerabilities in JavaScript applications. This kind of vulnerability allows an attacker to inject properties into an object's root prototype that may lead to flow control alteration and unexpected program behavior. Every time a successful exploit looks like magic or is limited to a denial of service (DoS). Would you be surprised if I told you that every application has a chain of methods that can be triggered by Prototype Pollution and leads to arbitrary …

applications attacker control denial of service dos exploit flow gadgets inject javascript javascript applications magic may object pollution program prototype rce root service vulnerabilities vulnerability