deephas 1.0.7 - Prototype Pollution

ExploitDBExploitDB exploitExploitEDB-52528

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that executes two Node.js payloads to pollute Object.prototype via deephas.set() using constructor.prototype and __proto__ paths, confirming vulnerability by reading polluted properties on empty objects.

Backdoor review

No backdoor observed in reviewed code

The PoC script is a straightforward demonstration of a prototype pollution vulnerability in deephas 1.0.7. It constructs two JavaScript payloads that pollute Object.prototype and then checks for the pollution. The Python wrapper only writes the payloads to a temp file, executes them with Node.js, captures output, and cleans up. No backdoor, persistence, credential theft, unrelated remote access, or concealed harmful behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonJavaScript
Target softwaredeephas
Attack typesPrototype Pollution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exercises the prototype pollution vulnerability by calling deephas.set() with malicious paths and verifying the resulting pollution on Object.prototype, which constitutes exploitation rather than mere detection.

exploits/multiple/webapps/52528.py:121-131exploits/multiple/webapps/52528.py:137-147

Requirements

  • Node.js must be installed and available in PATHexploits/multiple/webapps/52528.py:113-115
  • Vulnerable deephas@1.0.7 must be installed via npmexploits/multiple/webapps/52528.py:117-118

Observed behavior

  • Overwrites Object.prototype.hasOwnProperty to always return true, then calls deephas.set() with 'constructor.prototype.poc1' path and checks if {}.poc1 equals 'yes!!!'exploits/multiple/webapps/52528.py:121-131
  • Overwrites String.prototype.indexOf to always return -1, then calls deephas.set() with '__proto__.poc2' path and checks if {}.poc2 equals 'HACKED'exploits/multiple/webapps/52528.py:137-147
  • Prints VULNERABLE status if polluted values are observed on empty objectsexploits/multiple/webapps/52528.py:96-98
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
poc-deephas-temp.jsThe script writes JavaScript code to a temporary file for execution.exploits/multiple/webapps/52528.py:53-57
Process Execution
node <temp_file>The script executes the temporary JavaScript file using Node.js.exploits/multiple/webapps/52528.py:59-65
File Deletion
poc-deephas-temp.jsThe script deletes the temporary file after execution.exploits/multiple/webapps/52528.py:80-84
Prototype Pollution Payload
Object.prototype.hasOwnProperty = () => true; has.set(obj, 'constructor.prototype.poc1', 'yes!!!');The first PoC payload demonstrates prototype pollution via constructor.prototype.exploits/multiple/webapps/52528.py:122-126
Prototype Pollution Payload
String.prototype.indexOf = () => -1; has.set(obj, '__proto__.poc2', 'HACKED');The second PoC payload demonstrates prototype pollution via __proto__.exploits/multiple/webapps/52528.py:138-142
Review boundaries

What the analysis did not establish

  • Only the Python wrapper and embedded JavaScript payloads were analyzed; the deephas library source code was not inspected.
  • The script's actual execution and pollution success were not verified; analysis is based solely on static code review.
  • The review is limited to the supplied Python script. The deephas npm package and the Node.js runtime are not inspected. The script's behavior depends on the installed version of deephas, which is not verified by the script itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1