Example server-side prototype pollution check - Port Swigger
Summary: PortSwigger published a BCheck for Burp Scanner that tests for server-side prototype pollution by attempting to set the status property of Object.prototype to a specific value. The check sends an initial polluting request to JSON endpoints, forces an error with invalid JSON to see whether the response status becomes 510, then sends a follow-up request using a nullify variable to reset the status code to 0 and reports an issue with firm confidence if the code is not still 510.
What's compelling: Prototype pollution that reaches the server can let an attacker alter object behavior across requests, and this check exists because Burp Scanner can now flag it automatically - so a firm-confidence finding against your JSON endpoints is a signal to investigate rather than dismiss.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026