Prototype Pollution to RCE

A Node.js application uses a vulnerable merge function. Exploit prototype pollution to achieve RCE.

Vulnerable Code

function merge(target, source) {
  for (let key in source) {
    if (typeof source[key] === 'object') {
      target[key] = merge(target[key] || {}, source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

Endpoint

POST /api/settings
Content-Type: application/json

{"theme": "dark"}

Pollute Object.prototype, redirect execution through the merge path, and recover code execution.