一句话：首个能合成含复杂调用序列的可用漏洞利用的工具 Explode.js，用于确认 Node.js 包中的真实漏洞。
Node.js 生态漏洞频发，但现有漏洞检测工具为降低误报所合成的 PoC 利用，通常只能覆盖对导出函数单次直接调用即可触发的漏洞，难以处理需要复杂交互的漏洞。本文提出 Explode.js，首个能够合成包含复杂调用序列的漏洞利用的工具。它结合静态分析与符号执行，生成可实际执行的利用，从而确认命令注入、代码注入、原型污染与路径遍历漏洞的存在，有效消除误报。在两个包含已确认漏洞的最新 Node.js 包数据集上，Explode.js 生成的利用显著多于主要竞品；在真实 npm 包上还发现 44 个零日漏洞，其中 4 个获得新 CVE 编号。
The Node.js ecosystem, with its growing popularity and increasing exposure to security vulnerabilities, has a pressing need for more effective security analysis tools. To reduce false positives, recent works on detecting vulnerabilities in Node.js packages have developed synthesis algorithms to generate proof-of-concept exploits. However, these tools focus mainly on vulnerabilities that can be triggered by a single direct call to an exported function of the analyzed package, failing to generate exploits that require more complex interactions. In this paper, we present Explode.js , the first tool capable of synthesizing exploits that include complex call sequences to trigger vulnerabilities in Node.js packages. By combining static analysis and symbolic execution, Explode.js generates functional exploits that confirm the existence of command, code injection, prototype pollution, and path traversal vulnerabilities, effectively eliminating false positives. The results of evaluating Explode.js on two state-of-the-art datasets of Node.js packages with confirmed vulnerabilities show that it generates significantly more exploits than its main competitor tools. Furthermore, when applied to real-world Node.js packages, Explode.js uncovered 44 zero-day vulnerabilities, with 4 new CVEs.
@article{paperbot3073,
title = {Automated Exploit Generation for Node.js Packages},
author = {Filipe Marques and Mafalda Ferreira and André Nascimento and Miguel E. Coimbra and Nuno Santos and Limin Jia and José Fragoso Santos},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {PLDI},
year = {2025},
doi = {10.1145/3729304}
}