Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js · HackerPapers discussions

Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js — HN submission

Tue, 26 Jul 2022 14:51:28 GMT

Prototype Pollution Leads to Remote Code Execution in Node.js

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js — mentioned by belter

Mon, 25 Jul 2022 10:45:08 GMT

"...Prototype pollution is a dangerous vulnerability affecting prototype-based languages like JavaScript and the Node.js platform. It refers to the ability of an attacker to inject properties into an object's root prototype at runtime and subsequently trigger the execution of legitimate code gadgets that access these properties on the object's prototype, leading to attacks such as DoS, privilege escalation, and remote code execution (RCE)... ...We build the first multi-staged framework that uses multi-label static taint analysis to identify prototype pollution in Node.js libraries and…

Paper and discussion history. A mention is not an endorsement.

Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js — HN submission

Mon, 25 Jul 2022 10:42:42 GMT

Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js

1 point; 1 discussion reply on HN. Paper and source history. A submission is not an endorsement.