A Multivocal Literature Review on Prototype Pollution Vulnerability

JavaScript is one of the most widely used languages in modern web development. The unique way JavaScript inherits properties and methods between objects leads to a unique vulnerability called prototype pollution. In this paper, we study the problem in a holistic way using a multivocal literature review (MLR). It includes reviews of grey literature (GL) reviews in addition to formal literature to summarize the state of the art and current practice on this topic. We found that the impact of this vulnerability varies due to different implementations of JavaScript, e.g., denial of service (DoS), property injection, session fixation, remote code execution (RCE), privilege escalation, SQL injection, and cross-site scripting (XSS). We also found several methods to detect and mitigate prototype pollution. These include static analysis, dynamic analysis, and hybrid analysis for prototype pollution detection and analysis. Many concerned companies are also successfully mitigating the supply-chain risk of prototype pollution through security crowdsourcing, such as running a bug bounty program, managing an advisories database, and private reporting.