Lab: DOM XSS via an alternative prototype pollution vector

Pay attention to the XSS context. You need to adjust your payload slightly to ensure that the JavaScript syntax remains valid following your injection.

Find a prototype pollution source

1. In your browser, try polluting Object.prototype by injecting an arbitrary property via the query string:

   /?__proto__[foo]=bar

2. Open the browser DevTools panel and go to the Console tab.

3. Enter Object.prototype.

4. Study the properties of the returned object and observe that your injected foo property has not been added.

5. Back in the query string, try using an alternative prototype pollution vector:

   /?__proto__.foo=bar

6. In the console, enter Object.prototype again. Notice that it now has its own foo property with the value bar. You've successfully found a prototype pollution source.

Identify a gadget

1. In the browser DevTools panel, go to the Sources tab.

2. Study the JavaScript files that are loaded by the target site and look for any DOM XSS sinks.

3. Notice that there is an eval() sink in searchLoggerAlternative.js.

4. Notice that the manager.sequence property is passed to eval(), but this isn't defined by default.

Craft an exploit

1. Using the prototype pollution source you identified earlier, try injecting an arbitrary sequence property containing an XSS proof-of-concept payload:

   /?__proto__.sequence=alert(1)

2. Observe that the payload doesn't execute.

3. In the browser DevTools panel, go to the Console tab. Observe that you have triggered an error.

4. Click the link at the top of the stack trace to jump to the line where eval() is called.

5. Click the line number to add a breakpoint to this line, then refresh the page.

6. Hover the mouse over the manager.sequence reference and observe that its value is alert(1)1. This indicates that we have successfully passed our payload into the sink, but a numeric 1 character is being appended to it, resulting in invalid JavaScript syntax.

7. Click the line number again to remove the breakpoint, then click the play icon at the top of the browser window to resume code execution.

8. Add trailing minus character to the payload to fix up the final JavaScript syntax:

   /?__proto__.sequence=alert(1)-

9. Observe that the alert(1) is called and the lab is solved.

1. Load the lab in Burp's built-in browser.

2. Enable DOM Invader and enable the prototype pollution option.

3. Open the browser DevTools panel and go to the DOM Invader tab and reload the page.

4. Observe that DOM Invader has identified a prototype pollution vector in the search property i.e. the query string.

5. Click Scan for gadgets. A new tab opens in which DOM Invader begins scanning for gadgets using the selected source.

6. When the scan is complete, open the DevTools panel in the same tab as the scan, then go to the DOM Invader tab.

7. Observe that DOM Invader has successfully accessed the eval() sink via the sequence gadget.

8. Click Exploit. Observe that DOM Invader's auto-generated proof-of-concept doesn't trigger an alert().

9. Go back to the previous browser tab and look at the eval() sink again in DOM Invader. Notice that following the closing canary string, a numeric 1 character has been appended to the payload.

10. Click Exploit again. In the new tab that loads, append a minus character (-) to the URL and reload the page.

11. Observe that the alert(1) is called and the lab is solved.

Emanuele Picariello