论文标题
静音弹簧：原型污染导致Node.js中的远程代码执行
Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js
论文作者
论文摘要
原型污染是影响基于原型的语言（例如JavaScript和Node.js平台）的危险漏洞。它是指攻击者在运行时将属性注入对象的根原型中的能力，并随后触发了在对象原型上访问这些属性的合法代码小工具的执行，从而导致攻击，例如拒绝服务（DOS），特权升级和远程代码执行（RCE）。尽管有轶事证据表明原型污染导致了RCE，但当前的研究并未应对小工具检测的挑战，因此仅显示DOS攻击的可行性，主要是针对Node.js库。 在本文中，我们着手以整体方式研究该问题，从对原型污染的检测到检测小工具的检测，其雄心勃勃的目标是在完整的Node.js应用程序中找到DOS以外的端到端利用。我们构建了第一个使用多标签静态污染分析的多阶段框架，以识别Node.js库和应用中的原型污染，以及一种混合方法来检测通用小工具，特别是通过分析Node.js源代码。我们在GitHub的静态分析框架CodeQl之上实现了我们的框架，以在Core Node.js API中找到11个通用小工具，从而导致代码执行。此外，我们在对15个流行节点应用的研究中使用我们的方法来识别原型污染和小工具。我们在三个备受瞩目的应用程序（例如NPM CLI，Parse Server和Rocket.Chat）中手动利用八个RCE漏洞。我们的结果提供了令人震惊的证据，表明原型污染与强大的通用小工具相结合导致Node.js中的RCE。
Prototype pollution is a dangerous vulnerability affecting prototype-based languages like JavaScript and the Node.js platform. It refers to the ability of an attacker to inject properties into an object's root prototype at runtime and subsequently trigger the execution of legitimate code gadgets that access these properties on the object's prototype, leading to attacks such as Denial of Service (DoS), privilege escalation, and Remote Code Execution (RCE). While there is anecdotal evidence that prototype pollution leads to RCE, current research does not tackle the challenge of gadget detection, thus only showing feasibility of DoS attacks, mainly against Node.js libraries. In this paper, we set out to study the problem in a holistic way, from the detection of prototype pollution to detection of gadgets, with the ambitious goal of finding end-to-end exploits beyond DoS, in full-fledged Node.js applications. We build the first multi-staged framework that uses multi-label static taint analysis to identify prototype pollution in Node.js libraries and applications, as well as a hybrid approach to detect universal gadgets, notably, by analyzing the Node.js source code. We implement our framework on top of GitHub's static analysis framework CodeQL to find 11 universal gadgets in core Node.js APIs, leading to code execution. Furthermore, we use our methodology in a study of 15 popular Node.js applications to identify prototype pollutions and gadgets. We manually exploit eight RCE vulnerabilities in three high-profile applications such as NPM CLI, Parse Server, and Rocket.Chat. Our results provide alarming evidence that prototype pollution in combination with powerful universal gadgets lead to RCE in Node.js.
