Follow My Flow: Unveiling Client-Side Prototype Pollution Gadgets from One Million Real-World Websites

Prototype pollution vulnerability often has further consequences—such as Cross-site Scripting (XSS) and cookie manipulation—that are achieved via so-called gadgets, i.e., code snippets that change the control- or data-flow of a victim program for malicious purposes. Prior works face challenges in finding prototype pollution gadgets for such consequences because the control- or data-flow change sometimes needs the injection of complex property values to replace existing undefined ones through prototype pollution, which may not be seen before or cannot be solved by existing constraint solvers. In this paper, we design a dynamic analysis framework, called Gala, to automatically detect client-side prototype pollution gadgets among real-world websites, and implement an open-source version of Gala. Our key insight is to borrow existing defined values on non-vulnerable websites to victim ones where such values are undefined, thus guiding the property injection to flow to the sinks in gadgets. Our evaluation of Gala against one-million websites reveals 133 zero-day gadgets that are not found by prior works. For example, one gadget was from Meta's software and another from the Vue framework. Both have acknowledged and fixed it, with Meta rewarding us a bug bounty and Vue assigning CVE-2024-6783. Our evaluation also shows that 23 websites with prototype pollution vulnerabilities—which do not have further consequences as reported by prior works—have consequences due to gadgets found by Gala. In addition to the Meta and Vue gadgets, we also responsibly disclosed all the zero-day gadgets and those newly-discovered prototype pollution consequences to their developers.