Prototype Pollution

We need config.debug to be true if we want to inject some HTML on the page. Since debug is not defined in config the JS interpreter will look if the attribute is defined on the config prototype.

Because of the vulnerable merge function it is possible to assign the debug attribute of Object to 1.

If you access the __proto__ attribute of an object, it will give you the prototype of this object, here the prototype of user is Object, the same as config.

Our payload is split in two parts, first we set Object.debug to 1 and then we add a dummy attribute with the HTML payload.

$user = {"__proto__": {"debug": 1}, "x" : "<img src=x: onerror=alert(flag)>"}