Top 10 winner

Prototype Pollution

Sergey Bobrov, Mohan Sri Rama Krishna P, Terjanq, Beomjin Lee, Masato Kinugawa, Nikita Stupin, Rahul Maini, Harsh Jaiswal, Mikhail Egorov and Melar Dev

Client-side prototype pollution hunted at scale: query and hash parsers that write attacker-controlled keys onto Object.prototype, plus script gadgets in common libraries that turn a polluted property into JavaScript execution. The team automated detection with a Selenium bot, a Chrome extension and CodeQL, reporting around 80 bugs including reflected XSS on Apple, Jira and HubSpot.

Record

Researcher

Sergey Bobrov, Mohan Sri Rama Krishna P, Terjanq, Beomjin Lee, Masato Kinugawa, Nikita Stupin, Rahul Maini, Harsh Jaiswal, Mikhail Egorov and Melar Dev

In the archive

• Ranked #4 in the 2021 Top 10 Web Hacking Techniques

Related sources

• Research scanning extension
• CodeQL research discussion

Tags

• prototype-pollution
• gadget-chain
• xss
• filter-bypass
• javascript
• dom
• tooling
• large-scale-scan
• bug-bounty
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Sergey Bobrov, Mohan Sri Rama Krishna P, Terjanq, Beomjin Lee, Masato Kinugawa, Nikita Stupin, Rahul Maini, Harsh Jaiswal, Mikhail Egorov and Melar Dev, first published at the original source. Preserved copies are kept so the citation survives its host.