🧪 Labs › Client-Side
Prototype Pollution
Severity: Medium
Poison the base object every other object inherits from, and change behaviour everywhere.
What it is
In JavaScript, objects inherit from a shared prototype. If an app merges attacker-controlled data into an object without guarding special keys (__proto__, constructor, prototype), you can set properties on that shared prototype — and suddenly every object in the app appears to have them.
That can flip security flags, inject properties into templates, or set up gadget chains that reach code execution, both in the browser and in Node.
The sink is usually a recursive merge, a query-string parser, or a deep clone that doesn't exclude the magic keys.
How to approach it
- Find a place where structured input is merged into an object — JSON bodies, query strings, config.
- Try to set a property via the prototype keys and then check whether an unrelated object now has it.
- Look for a 'gadget' — somewhere the app reads a property that, if present on the prototype, changes behaviour.
- Reason from the polluted property to an actual security impact.
Your task
Set a property on the object prototype and use it to change how the application behaves for everyone.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Reject or strip __proto__/constructor/prototype keys in merges and parsers.
- Use Map or null-prototype objects for untrusted key/value data, and freeze prototypes.
- Prefer libraries hardened against prototype pollution.
More Client-Side labs
- Web Cache Deception & Poisoning — Trick the cache into storing the wrong thing — then serve it to everyone.
- Cross-Site Request Forgery (CSRF) — Make a logged-in victim's browser send a state-changing request they never intended.