Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences

Prototype pollution is a type of recently-discovered, impactful vulnerability that affects JavaScript code. One important yet challenging research problem of prototype pollution is how to affect the logic—or precisely the controlor data-flow—of a target program and achieve an adversary’s malicious purpose such as Arbitrary Code Execution (ACE) and File Access Manipulation. Prior works have studied the detection of so-called gadgets, which lead polluted properties to flow to sinks related to code execution. While existing gadgets are successful in achieving malicious purposes, they are direct gadgets, i.e., flowing from polluted property directly to a sink without the influence of other polluted properties. However, given more and more gadgets are being fixed and the lack of direct gadgets in some libraries, the necessity for more complicated gadgets arises accordingly.In this paper, we design and implement the first framework, called Undefined-oriented Programming Framework (UOPF), to detect and chain gadgets that lead to sinks via concolic execution with undefined properties as symbols. We call it Undefined-oriented Programming because one gadget may alter the control- or data-flow of another gadget via polluting additional originally-undefined properties. UOPF generates both prototype pollution and normal program inputs to guide concolic execution to reach sinks. Our evaluation on Node.js template engines shows that UOPF detects 25 zero-day gadgets that existing works cannot detect and 13 of them are chained ones. We responsibly report these gadgets to their developers and five gadgets have already been fixed. We also compare UOPF with Silent Spring, the state-of-the-art gadget detection tool and our evaluation shows that UOPF outperforms Silent Spring significantly in both false positive and negative rates.