Checking NPM Libraries for Known Prototype Pollution Vulnerabilities part 3

Hackbyknowledge

12 min read

·

Dec 21, 2024

--

Listen

Share

Checking NPM Libraries for Known Prototype Pollution Vulnerabilities

now come to the aur application tat is aws-lab1-lab2 folder . here we going how we can identifie vulnerble libraries .At its core, Lodash is designed to simplify and streamline the process of working with arrays, objects, and other data types in JavaScript. Its functionality ranges from simple utility functions like map, filter, and reduce, to more complex operations like deep cloning objects, merging arrays, and much more.

LAB LINK : https://drive.google.com/drive/folders/1oqnjzOMM1xzPdUBjWeAz0lDGrKCw9iLv?usp=sharing

here u can see 3 vulnebilitye and 1 is criticle , to fix u can run below command(this we see later).At its core, Lodash is designed to simplify and streamline the process of working with arrays, objects, and other data types in JavaScript. Its functionality ranges from simple utility functions like map, filter, and reduce, to more complex operations like deep cloning objects, merging arrays, and much more.

so whenever u get anaylzie to code base this good way to start.

here we can see how many vulnbiliies in our application

above img sove links useless but some ares very usefull to read and undrstand.

npm audit — json

and here its give result as a json objection containing the all of the vulnebilities and all of he metadata which can be very usefull for slightly deeper inspection but automation , if you want to pass this into a tool or some kind of dashboard or somethiing like this a lots of tools work nicely with json so this is pretty usefull .

now if we want to fix this issue within the application . this does fix withough breaking changes in application.

npm audit fix

this vill automticly updaing a dependeicy to non vulneble version.

npm audit fix — force

so this is do break chnages in code .

when we want to update single module , with latest version, where prototype pollution vulnerbility has been patched.

npm install lodash@4.1

this are some key things when running nmp audit ,, this is veryr usefull for getting quick review of known vulnerbility .

next we will see how we can build a script to automatically craws libaraies to downloade them and test them for prototype pollution and see whetehr we can find some vulnebilities and vulnerble libaries.

Finding Undiscovered Prototype Pollution in NPM Libraries

Press enter or click to view image in full size

here above u know about prototype pollution and and bunch of common and popular lybraris that afftected by prototype pollution vulnerbilities.

olivier arteau prottype pollution attack in node js appllication bread this belwo url . this is intrasing and graret insight here about prototype pollutiion .

now come to the github

here u cans see find vuls.js script . here we going to use it .then going to witr bash script.

dowlode raw file save n computer

Press enter or click to view image in full size

we install vulnerble lodash library , have look to see wheather detection works, then we gonne chnage library , install non-vulnerble version and scan it again and now we are going to look we can harvest modules and apply same techniq across many , many npm libraries.

npm i lodash@4.17.4

you can see here find.jsvul.js scan the libarary so u can see alot . but we are actaully looking for this below image Detected.

Press enter or click to view image in full size

its look like we potentially have prottype pollution in libarary .

now offcourse we need to go and and verify this ,if this unknown vulnerbility . we didnt know this actaully vulnerble or not, so always we need to do next step and verify its vulneble or not .but this is a good starting point here .

Press enter or click to view image in full size

now we going to build create script that will automatically find libraries with specific names or similar to names downloads them test them and then report the result.

#!/bin/bash

LOG_FILE="log.txt"
FOUND_FILE="found.txt"

# Step 1: User input for keywords, popularity score range, and number of modules to check
read -p "Enter keywords to search for: " keywords
read -p "Enter the minimum popularity score (0 to 1): " min_popularity
read -p "Enter the maximum popularity score (0 to 1): " max_popularity
read -p "Enter the number of modules to check: " num_modules
read -p "Enter the timeout (in seconds) for each operation: " timeout

# Step 2: Query NPM for packages based on user input
echo "Querying NPM for packages with keywords: '$keywords'..."
NPM_SEARCH_RESULT=$(curl -s "https://registry.npmjs.org/-/v1/search?text=$keywords&size=100" | jq '.objects[] | {name: .package.name, popularity: .score.detail.popularity}')

# Convert the NPM result to an array of packages with their popularity score
PACKAGES=($(echo $NPM_SEARCH_RESULT | jq -c '.'))

TOTAL_PACKAGES=${#PACKAGES[@]}

if [ $TOTAL_PACKAGES -eq 0 ]; then
    echo "No packages found with the criteria: keywords='$keywords'."
    exit 1
fi

# Step 3: Filter packages based on popularity score range and log file
FILTERED_PACKAGES=()
for PACKAGE in "${PACKAGES[@]}"; do
    NAME=$(echo $PACKAGE | jq -r '.name')
    POPULARITY=$(echo $PACKAGE | jq -r '.popularity')

    # Skip if package is already in log.txt
    if grep -q "^$NAME$" "$LOG_FILE" 2>/dev/null; then
        echo "$NAME already checked, skipping..."
        continue
    fi

    if (( $(echo "$POPULARITY >= $min_popularity && $POPULARITY <= $max_popularity" | bc -l) )); then
        FILTERED_PACKAGES+=("$NAME")
        echo "$NAME meets the popularity criteria with a score of $POPULARITY"
    else
        echo "$NAME does not meet the popularity criteria (popularity score: $POPULARITY)"
    fi

    # Stop once the required number of modules is reached
    if [ ${#FILTERED_PACKAGES[@]} -ge $num_modules ]; then
        break
    fi
done

TOTAL_FILTERED=${#FILTERED_PACKAGES[@]}
if [ $TOTAL_FILTERED -eq 0 ]; then
    echo "No packages found within the popularity score range of $min_popularity to $max_popularity."
    exit 1
fi

# Step 4: Process packages in batches of 10
BATCH_SIZE=10
for (( i=0; i<$TOTAL_FILTERED; i+=$BATCH_SIZE )); do
    BATCH=("${FILTERED_PACKAGES[@]:i:BATCH_SIZE}")
    echo "Processing batch: ${BATCH[@]}"

    # Install packages in batch with timeout
    echo "Installing packages..."
    for PACKAGE in "${BATCH[@]}"; do
        echo "Installing $PACKAGE..."
        timeout $timeout npm install "$PACKAGE" --silent
        if [ $? -ne 0 ]; then
            echo "Failed to install $PACKAGE or timed out after $timeout seconds"
            continue
        fi
    done

    # Run pollution-checker.js for each package in batch with timeout
    VULNERABLE_PACKAGES=()
    echo "Running pollution-checker.js on installed packages..."
    for PACKAGE in "${BATCH[@]}"; do
        echo "Running pollution checker for $PACKAGE..."
        OUTPUT=$(timeout $timeout node pollution-checker.js "$PACKAGE")
        if [ $? -ne 0 ]; then
            echo "Pollution check for $PACKAGE timed out after $timeout seconds or failed"
            continue
        fi

        if echo "$OUTPUT" | grep -q "Detected : "; then
            echo "Detected prototype pollution in $PACKAGE"
            VULNERABLE_PACKAGES+=("$PACKAGE")
            echo "$PACKAGE" >> "$FOUND_FILE"  # Log vulnerable package to found.txt
        else
            echo "No vulnerability detected in $PACKAGE"
        fi

        # Log the package name to log.txt
        echo "$PACKAGE" >> "$LOG_FILE"
    done

    # Remove installed packages
    echo "Removing installed packages..."
    for PACKAGE in "${BATCH[@]}"; do
        echo "Removing $PACKAGE..."
        timeout $timeout npm uninstall "$PACKAGE" --silent
        if [ $? -ne 0 ]; then
            echo "Failed to uninstall $PACKAGE or timed out after $timeout seconds"
        fi
    done
done

# Step 5: Show summary of vulnerable packages
if [ -f "$FOUND_FILE" ]; then
    echo "=== Vulnerable Packages Found ==="
    cat "$FOUND_FILE"
else
    echo "No vulnerabilities detected in the tested packages."
fi

echo "Process completed!"

here we craete code file then log file . its will scan libaray that is populr and scan libaray that is less popular but still use in .

now change find.jsvul.js to pollution-cheker.js same file name .

Press enter or click to view image in full size

Press enter or click to view image in full size

it will go though all libararis related to keywords then it will hits according to our requeirenment.

Press enter or click to view image in full size

here its check 10 pakages. obisuly we can check 100 pakages or 50 or 500 and just leave at night running out.

Press enter or click to view image in full size

Press enter or click to view image in full size

Press enter or click to view image in full size

above image u can see here we have some detection. here we know potential this library vulnerble to prototype pollution

npm audit

Press enter or click to view image in full size

as we know this deep library is potential vulneble to prototype poolition vulerbility that is Arbitary code executaion in underscore (see in above imge)

now verify protoype vunerbility so build a very small prof of concept . and then install the library and demostrate it working .

go — https://www.npmjs.com/

search for this package — deep

u will get extact match.

hopefully no one using deep package in production

so deep libraray using buch of vulnerble modules .

here u can report them who usiing vulneble modules

Here is prof of concept.

so at the end u use this techniq at if u want to check package acroos the application that your organization use, it will give easy way to do that .

Capstone Challenge Introduction

here u have to do practicle so it depend on you hoow to test it , if u want to test as a live application which no access backend or if

u want to do some analysis and put your debuggiing skills use then offcourse , we can spin it up vs code and do that as well.

to run app we nedd to instal packages . npm install

then run node app.js to run application.

here we will approach prototuype plution like in real senario application ,

create account in application

create task- delete — edit —

here we will not test everything manulay

i will do front end js anayylsis

keep on eye like out of jquery libraries

and look for merging of objects and things like that .

burp browser dom invader

Press enter or click to view image in full size

Press enter or click to view image in full size

scan for gatget on

in dom envader u u dont get any result then look for alternatives.

here its liik like its fond our sync in element.innerHTML

?_pro_proto_to_[message]=”%27><img+scr+onerror%3Dalert%3Dalert%281%29>

?_pro_proto_to_[message]=<img src=”x” onerror=”alert(1);”>

now we also look into some sources. and main thing to consider is , we have merge.js script . if we annyasize his code

but this a weak filter because its not actually going through recursively .
and so this kind of common mistake that we used to see alot of, not so much thease days .
but its nice little bit of extra challenge from a code review perspective.

and offousre many older applications that are using things like out of date jquery or older libraries that cant be fixed
the devlopers might have thrown in a quick fix like this . and the offcousre we need to test everytime
we have a filter or something that enforces security , we should test that.

start o build our paylaode
?__proto__[message]=hello
unfortunalty this not work beacuse of filetr
we might able to byass this fileter
?__pro__proto__to__[message]=hellthere

hellotehre is bellow image

now i would like to add xss paalode instead of hellothere

?__pro__proto__to__[message]=”><script>alert(2)</script>

Press enter or click to view image in full size

now we testing script or payloade
add breakpoints

Press enter or click to view image in full size

breakpoints helps to undertsand code, validations,

ok now we will find prototype pollution diffrenet approach that is code approach we will look at VS code

here u can see app.js using this libraries

check each and every functionality undestanding

some cases object.assign is vulnerable .

Press enter or click to view image in full size

debug the application queliy

{“__proto__”:{“polluted”:true}}

Press enter or click to view image in full size

Press enter or click to view image in full size

in vscode we can see we have prottpe pollution here we dont need to bypass anyfilters . we just need to find needed to find the vulerable endpoints.

and if we doing this from the frontend without seeing the backend , once again we can do this (below)

{“__proto__”:{“status”:599}}

Press enter or click to view image in full size

now broke json and send again

Press enter or click to view image in full size

here u can also create your payloade by deepending your code

{“__proto__”:{“role”:”admin”}}

Press enter or click to view image in full size

here its allow to access admin page

Press enter or click to view image in full size

now i recomeded if when u searcheing for impactfull pyaloade code review really helps but sometimes things like json web token or response can give u properties to target , of course claims in json web token are sometimes quite sensetive , so those , could be good target , or if u go to something like / (slash ) account and its an API endpoint and it return all of the properties user object , then again, you can attacking those for e.g may be we can overide the propertiy and that might be lead to imformation disclosure , we might able to change path , for e.g , to sensetive files there is alot of things we can do and offcousre if we found eval in backedn code , as well , we might able to get remote code execuation, so thats always somethings to be on lookout for dangeroius sinks and daerious function like eval but offcousre objects and how they work , i think are the main thing to be analayze for an imapctfull payloade .

====

now we will see how to find prototype pollutionn using burpsuite scaaner extesion

Press enter or click to view image in full size

rightclick in repeter tab then go to full body scan

Press enter or click to view image in full size

thank you