Skip to content
attack.paths
Sign in
← RegistryDossier · 5 steps · 4 edges

Server-side prototype pollution → auth bypass → RCE

Merge / clone helper on user input pollutes Object.prototype. A later code path reads `isAdmin` from a fresh object and gets true — then a child-process gadget reaches RCE.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: Node.js app using lodash.merge / set-value / hoek / similar on a request body without sanitisation. Application reads booleans from plain objects with defaults.

§ Steps

  1. 01
    Code execution on next spawn()Execution
    T1059— Command and Scripting Interpreter
  2. 02
    Pollute child-process options gadgetExecution
    W-PROTOTYPE-SERVER— Server-Side Prototype Pollution → RCE

    execArgv / shell.

  3. 03
    Pollute Object.prototype.isAdminExecution
    W-PROTOTYPE-SERVER— Server-Side Prototype Pollution → RCE

    {"__proto__":{"isAdmin":true}}

  4. 04
    Find unsafe merge sinkReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  5. 05
    Reach admin pathPrivilege Escalation
    W-BFLA— Broken Function Level Authorization (API BFLA)

§ References

§ Frequently asked

What is the "Server-side prototype pollution → auth bypass → RCE" attack path?
Merge / clone helper on user input pollutes Object.prototype. A later code path reads `isAdmin` from a fresh object and gets true — then a child-process gadget reaches RCE. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Code execution on next spawn() (T1059) — a execution primitive. Assumed environment: Node.
What is the final impact of this kill-chain?
The final step lands on Reach admin path (W-BFLA), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers