Prototype Pollution Leads to Remote Code Execution in Node.js
Mikhail Shcherbakov and Musard Balliu uncover universal Prototype Pollution gadgets within Node.js core and popular NPM packages, achieving RCE across major applications.
Summary
Prototype Pollution Beyond Denial of Service
Prototype pollution in JavaScript applications has often been dismissed as a low-severity flaw resulting merely in property injection or denial of service.
Discovering Universal Gadgets in Node.js Core
Mikhail Shcherbakov and Musard Balliu analyze Node.js core libraries and popular NPM dependencies, mapping out universal gadget chains that convert object property modifications into code execution.
Auditing 15 Popular Applications to Yield 8 RCEs
Applying automated static and dynamic analysis across 15 open-source Node.js applications on GitHub yielded 8 high-impact remote code execution zero-days.
Mitigations and Node.js Architectural Hardening
The researchers discuss recent security enhancements in Node.js, including `--disable-proto` flags and defensive coding patterns to prevent prototype poisoning.
Related talks
Main Stage·30 min
Feng Xiao
Feng Xiao presents Hidden Property Abusing (HPA), a novel attack vector exploiting internal Node.js runtime properties to achieve arbitrary code execution.
Main Stage·46 min
Mikhail Shcherbakov
Advanced JavaScript and TypeScript exploit primitives turning theoretically unexploitable flaws in Kibana into working code execution.
Main Stage·31 min
Feng Xiao
Feng Xiao answers audience questions on Hidden Property Abusing (HPA), JavaScript runtime internals, and securing NPM libraries.