一句话：提出对象查找分析，以静态检测 Node.js 中因原型链和细粒度对象关系难以发现的 prototype pollution 漏洞。
原型污染是 JavaScript 等基于原型的语言特有漏洞，攻击者可污染基对象属性，进而导致 DoS、任意代码执行和会话固定等后果。此前唯一检测工作采用动态分析 fuzz 包输入，难以覆盖深层漏洞；而将现有静态分析用于该问题也面临挑战，因为需要处理原型链以及包括内建对象在内的细粒度对象关系。本文提出对象查找分析（object lookup analysis），以建模对象属性查找与原型链关系，从而检测 Node.js 包中的原型污染漏洞。摘要未报告具体实验数据或对比结果。
Prototype pollution is a type of vulnerability specific to prototype-based languages, such as JavaScript, which allows an adversary to pollute a base object’s property, leading to a further consequence such as Denial of Service (DoS), arbitrary code execution, and session fixation. On one hand, the only prior work in detecting prototype pollution adopts dynamic analysis to fuzz package inputs, which inevitably has code coverage issues in triggering some deeply embedded vulnerabilities. On the other hand, it is challenging to apply state-of-the-art static analysis in detecting prototype pollution because of the involvement of prototype chains and fine-grained object relations including built-in ones.
DOI 原文 ·
@inproceedings{paperbot6312,
title = {Detecting Node.js prototype pollution vulnerabilities via object lookup analysis},
author = {Song Li and Mingqing Kang and Jianwei Hou and Yinzhi Cao},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3468542}
}