Abstract

Over the years, interest in nodejs Server Side JavaScript has been growing.

prototype pollution is a unique vulnerability in prototype based language like javascript. This has become a recent topic in modern web security and prototype vulnerabilities has been found in many popular libraries.

However, there has not been enough research on how this could have a ripple effect beyond DOS.

through personal research, I was able to increase the possibility of exploitation in the Real World from finding the vulnerabilities in the libraries frequently used in application configuration to nodejs internals and different types of parser, collected exploit methods from many edge cases.

In this presentation will be focused on how the context injection technique by prototype pollution vulnerability can actually be used practically in nodejs. I will introduce how to escalate the impact of the logical vulnerability that is overlooked, from DOS, to the RCE in many cases.