Collected research
Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences
Prototype pollution gadgets found by prior work are direct: a polluted property flows straight to a sink. This paper defines chained gadgets, in which one polluted undefined property alters the control- or data-flow of another, and builds a concolic-execution framework that treats undefined properties as symbols in order to detect and chain them. Applied to Node.js template engines it reports 25 zero-day gadgets, 13 of them chained, reaching code-execution and XSS sinks.
Record
- Researcher
- Zhengyu Liu, Kecheng An and Yinzhi Cao
- Published by
- yinzhicao.org
- Format
- Whitepaper
- Topic
- Injection
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Zhengyu Liu, Kecheng An and Yinzhi Cao, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .