Prototype Pollution Leads to RCE: Gadgets Everywhere

on YouTube ↗40m

" summary

Claims automated analysis finds over 10 real RCEs by chaining Prototype Pollution into usable gadgets across Node core and popular NPM packages, with concrete exploits: abusing npm CLI spawn options (polluting nth to control git SSH command), hijacking spawn.shell to run node with a remote debugger via internal inspect client, and combining a JS-BSON eval enabled gadget with a race condition against Parse Server + MongoDB to execute code. Tools include static queries, dynamic tracing (strace/citrace) and a prototype-pollution detector; mitigations include using Object.create(null) or copying only own properties.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to pollution
2. 1:33JavaScript prototype model
3. 3:44Pollution to remote code
4. 6:48Real world case study
5. 10:21Node.js core gadgets
6. 15:07Require gadgets analysis
7. 21:01Mitigations and bypasses
8. 24:36Exploiting 3rd party libs
9. 30:18Exploitation techniques
10. 33:32Defense and conclusion

" related talks

• 34mReal World JavaScript SecurityAmanvir Sangha · Devoxx Belgium 2019
• 48mPreloading Insecurity In Your ElectronLuca Carettoni · Black Hat Asia 2019
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 29mHack Me if You CanDani Coll · DevWorld 2026
• 41mServer Side Prototype PollutionGareth Heyes · Global AppSec Dublin 2023
• 20mAutomated Exploit Generation for Node.js PackagesLimin Jia, José Fragoso Santos, Mafalda Sofia Ferreira, Miguel E. Coimbra, Nuno Santos, Filipe Marques, André Nascimento · PLDI 2025
• 51mStranger Danger: Your Node.js Attack Surface Just Got BiggerLiran Tal · Voxxed Days Zürich 2022
• 42mDon't trust the DOM: Bypassing XSS mitigations via script gadgetsS. Lekies · OWASP BeNeLux Day 2017