Prototype Pollution Detection for Node.Js Applications: A Review

Abstract

Prototype pollution is a critical vulnerability that affects JavaScript environments, including Node.js. This vulnerability arises from the dynamic nature of JavaScript, allowing attackers to manipulate the prototype of objects and inject malicious properties into them. In Node.js applications, prototype pollution can lead to severe security threats, including Remote Code Execution (RCE) and Cross Site Scripting (XSS) attacks.
Research in the Prototype pollution vulnerability detection and exploitation in Node.js has seen significant advancements. Various techniques, such as Symbolic/ Concolic testing, static analysis, and dynamic taint analysis, have been employed to effectively detect and exploit prototype pollution vulnerabilities. Tools and frameworks, such as UOPF (Undefined oriented Programming Framework) and Silent Spring, have been developed to automate detecting and chaining prototype pollution gadgets in Node.js template engines.
Prototype pollution vulnerabilities in Node.js are particularly challenging due to the complex nature of JavaScript applications and the diversity of libraries and frameworks used in Node.js development. Therefore, researchers continue to explore new methods and techniques to improve the detection and mitigation of prototype pollution vulnerabilities in Node.js environments.