一句话：在执行前插桩 sink API 及相关对象，运行时捕获 sink 调用与参数，以验证并分类 Node.js 漏洞的 exploit。
Node.js 生态中的漏洞构成严重安全威胁，而为漏洞构造 exploit 是修复漏洞、理解攻击向量的关键步骤。已有工作涵盖静态分析、动态分析与基于 LLM 的方法，但多数方法只在执行结束时检查漏洞的预期效果是否出现，因而无法确认 exploit 是否真正到达目标的脆弱 sink，可能导致未能触发目标漏洞或误触发了另一个 sink。本文提出一种针对 Node.js 漏洞 exploit 的验证与分类方法：在执行之前对 sink API 及相关对象进行插桩，当 sink 在运行时被触发时捕获 sink API 调用及其参数。基于这些信息，作者可以验证 exploit 是否到达预期的 sink，并按照 sink 被触发的时点对 exploit 进行分类。
Vulnerabilities in the Node.js ecosystem pose serious security threats. Generating exploits for such vulnerabilities is a critical and essential step for fixing the vulnerabilities and understanding attack vectors. To address this need, prior work has proposed a range of methods, including static analysis approaches, dynamic analysis approaches, and LLM-based techniques. However, most studies verify only at the end of execution whether the expected effect of each vulnerability has occurred. This approach does not confirm whether the exploit actually reaches the target vulnerable sinks. As a result, it may fail to exercise the intended vulnerability or inadvertently trigger a different sink.In this study, we propose a method for validating and classifying exploits related to Node.js vulnerabilities. Our method instruments sink APIs and related objects prior to execution to capture sink APIs calls and their arguments when a sink is triggered at runtime. This lets us verify that an exploit reaches the intended sink and classify exploits by the point at which the sink is triggered.
DOI 原文 ·
@inproceedings{paperbot9279,
title = {Verification and Classification of Exploits for Node.js Vulnerabilities},
author = {Sungmin Park},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00390}
}