Finding client-side prototype pollution with DOM Invader
Summary: PortSwigger upgraded its DOM Invader tool in Burp Suite 2022.6 to detect client-side prototype pollution (CSPP) in a few clicks, testing the query string, hash, and JSON objects sent via web messages and reporting successful sources. The tool can then scan for gadgets automatically, and a green Exploit button combines a discovered source with a gadget to generate a prototype pollution exploit; using these techniques the author reports finding CSPP on a well known car manufacturer, a well known game site, and a major WordPress domain.
Key Takeaway: Prototype pollution needs only a source and a gadget, and the gadget here ends in an innerHTML sink that developers assume is not user controlled, which is how it becomes XSS. The author found live CSPP on a car manufacturer, a game site, and a major WordPress domain, so the pattern is present on sites that were not looking for it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026