Discovering Hidden Properties to Attack Node.js Ecosystem (Q&A)
Feng Xiao answers audience questions on Hidden Property Abusing (HPA), JavaScript runtime internals, and securing NPM libraries.
Summary
In this live Q&A session from the DEF CON Safe Mode Main Stage, security researcher Feng Xiao answers community questions following his presentation on discovering hidden properties to attack the Node.js ecosystem. Opening at 00:15, Feng discusses the practical mechanics of Prototype Pollution and HTTP Parameter Pollution (HPP) in modern JavaScript applications.
At 08:02 and 16:06, Feng shares his vulnerability research methodology, describing how he combined manual code auditing of popular npm packages with automated semantic fuzzing to uncover exploitable property injection flaws across major web frameworks.
Concluding at 24:01, Feng addresses defensive mitigations, advising software developers to use Object.freeze() on base prototypes, validate JSON schemas, and avoid recursive object merges to protect production Node.js applications against unauthorized privilege escalation and remote code execution. (AI summary — Gemini Flash)
Related talks
Main Stage·30 min
Feng Xiao
Feng Xiao presents Hidden Property Abusing (HPA), a novel attack vector exploiting internal Node.js runtime properties to achieve arbitrary code execution.
Main Stage·46 min
Mikhail Shcherbakov
Advanced JavaScript and TypeScript exploit primitives turning theoretically unexploitable flaws in Kibana into working code execution.
Main Stage·20 min
Mikhail Shcherbakov · Musard Balliu
Mikhail Shcherbakov and Musard Balliu uncover universal Prototype Pollution gadgets within Node.js core and popular NPM packages, achieving RCE across major applications.