# Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)

deparam parsing of location.hash in Swiftype's st.js allows prototype pollution, chained with an eval gadget to achieve DOM XSS on blog.swiftype.com.

- Payout: hidden
- Severity: high
- Program: Elastic
- Found by: s1r1u5
- Disclosed: 2021-08-16
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/998398
- Library page: https://bugbountylibrary.com/r/h1%3A998398
- Tags: area:web domain:web kind:bounty platform:hackerone sev:high technique:chained technique:source-review vuln:prototype-pollution vuln:xss

**Target:** JavaScript library st.js parsing location.hash on *.swiftype.com
**Root cause:** deparam recursively assigns attacker-controlled hash keys into a plain object without blocking __proto__, polluting Object.prototype; a gadget then evals values from _userServerConfiguration.install.hooks.
**Steps:**
1. Visit `https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)`
2. Refresh if popup does not appear
3. deparam parses hash and sets `__proto__[asd]` on Object.prototype
4. _convertStringHooksToFunctions iterates hooks and calls `eval(hookFunction)`, executing the polluted value
**How found:** Code review of st.js identified the deparam function's unsafe recursive assignment into objects, then searched the same file for a sink consuming polluted properties, finding the eval in _convertStringHooksToFunctions.
**Exploitation:** Attacker crafts a URL fragment with `__proto__[asd]=alert(document.domain)`; when a victim loads the page, deparam pollutes Object.prototype and the eval-based hook converter executes the injected string, running script in the target origin.
**Insight:** When auditing client-side deparam/query parsers, grep the same bundle for sinks that iterate or eval object properties (e.g. $.each over config objects, eval, innerHTML) — pollution only matters if a gadget consumes the polluted key.