Detecting Node.js prototype pollution vulnerabilities via object lookup analysis-Reference-Cited by-同舟云学术

Detecting Node.js prototype pollution vulnerabilities via object lookup analysis

Published:2021-08-18 Issue: Volume: Page:
ISSN:
Container-title:Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
language:
Short-container-title:

Author:

Li Song¹,Kang Mingqing¹,Hou Jianwei²,Cao Yinzhi¹

Affiliation:

1. Johns Hopkins University, USA

2. Johns Hopkins University, USA / Renmin University of China, China

Funder

NSF (National Science Foundation)

DARPA

Publisher

ACM

Link

https://dl.acm.org/doi/pdf/10.1145/3468264.3468542

Reference54 articles.

1. [n.d.]. Brave PageGraph. https://github.com/brave/brave-browser/wiki/PageGraph [n.d.]. Brave PageGraph. https://github.com/brave/brave-browser/wiki/PageGraph

2. [n.d.]. Istanbul’s state of the art command line interface. https://www.npmjs.com/package/nyc [n.d.]. Istanbul’s state of the art command line interface. https://www.npmjs.com/package/nyc

3. [n.d.]. Node simple OData server. https://github.com/pofider/node-simple-odata-server [n.d.]. Node simple OData server. https://github.com/pofider/node-simple-odata-server

4. [n.d.]. Parser utility to generate ASTs from PHP source code suitable to be processed by Joern. https://github.com/malteskoruppa/phpjoern [n.d.]. Parser utility to generate ASTs from PHP source code suitable to be processed by Joern. https://github.com/malteskoruppa/phpjoern

5. [n.d.]. SES. https://github.com/tc39/proposal-ses [n.d.]. SES. https://github.com/tc39/proposal-ses

Cited by 28 articles. 订阅此论文施引文献订阅此论文施引文献，注册后可以免费订阅5篇论文的施引文献，订阅后可以查看论文全部施引文献

1. Efficient Static Vulnerability Analysis for JavaScript with Multiversion Dependency Graphs;Proceedings of the ACM on Programming Languages;2024-06-20

2. Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences;2024 IEEE Symposium on Security and Privacy (SP);2024-05-19

3. Unveiling the Invisible: Detection and Evaluation of Prototype Pollution Gadgets with Dynamic Taint Analysis;Proceedings of the ACM Web Conference 2024;2024-05-13

4. RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains;Proceedings of the IEEE/ACM 46th International Conference on Software Engineering;2024-04-12

5. Detecting prototype pollution for node.js: Vulnerability review and new fuzzing inputs;Computers & Security;2024-02