06/10/2025
Bug Bounty Hunters! 🚀 Listen up, because this isn't just a story, it's a $10,000 lesson! 💸
A hacker named Phoenix Catalan shared a story about a vulnerability that was already patched, but he managed to re-exploit it and score a 10K bounty! Imagine going from "not an admin" to... an admin with just a simple piece of code! That's exactly what happened with this Prototype Pollution vulnerability! 🤯
What's Prototype Pollution all about? 😈
It all starts with a seemingly innocent Node.js server, and a developer who decided to use a popular library called deep-extend to merge Objects. But unfortunately, that library had an old, vulnerable version, which opened a dangerous backdoor!
In a nutshell: Some JavaScript libraries allow you to inject properties into the global object prototype. What does that mean? Any change you make to that prototype affects every Object in the application! It's a disaster waiting to happen, right?
What does a smart hunter do? 🎯
To exploit a vulnerability like this, a hacker needs three things:
* A Pollution source: A place where they can inject malicious properties into the prototypes (like __proto__ or constructor).
* A Sink: A function or behavior in the application that uses those polluted properties (like eval, DOM manipulation, or even access checks).
* An Exploitable Gadget: A specific property that, once polluted, triggers unexpected or dangerous behavior.
How did Phoenix Catalan do it and get paid? 💰
The scenario was as follows:
The website allowed users to update their profiles through a POST request to /update-profile. The developer had a field called isAdmin set to false by default (meaning the user wasn't an admin).
But here's where the magic happened! The hacker used a tool like Insomnia to send a malicious JSON object to the server, exactly like this:
{
"__proto__": {
"isAdmin": true
}
}
What happened next?
The vulnerable deep-extend library, when it tried to merge this JSON object, injected isAdmin: true into the Object.prototype on the server!
And BOOM! 💥
The result was shocking: Any user on the application, even without logging in or having any privileges, was treated as an admin! Meaning full access, full control... and a security nightmare!
Why is a vulnerability like this so dangerous? ⚠️
Server-side Prototype Pollution doesn't just affect the Frontend. In Node.js, if the Object.prototype is polluted, it affects every object created afterward, even the system-level ones! So if the server uses logic like if (user.isAdmin), and that prototype was polluted with isAdmin: true, then every user becomes an admin, even if they shouldn't!
That's what makes this vulnerability so devastating: It's global, silent, and difficult to detect once exploited!
How to protect yourself from this disaster? 🛡️
* Avoid vulnerable libraries: like deep-extend@
