GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes
Eric Cornelissen, Mikhail Shcherbakov, Musard Balliu

TL;DR
This paper introduces GHunter, a system for detecting prototype pollution gadgets in JavaScript runtimes like Node.js and Deno, revealing new vulnerabilities and providing systematic mitigation guidelines.
Contribution
GHunter is the first systematic pipeline to detect gadgets in JavaScript runtimes, combining dynamic analysis with manual validation, and it uncovers numerous new vulnerabilities.
Findings
Identified 56 new gadgets in Node.js and 67 in Deno.
Discovered vulnerabilities including remote code execution and privilege escalation.
Provided systematic mitigation guidelines for prototype pollution gadgets.
Abstract
Prototype pollution is a recent vulnerability that affects JavaScript code, leading to high impact attacks such as arbitrary code execution. The vulnerability is rooted in JavaScript's prototype-based inheritance, enabling attackers to inject arbitrary properties into an object's prototype at runtime. The impact of prototype pollution depends on the existence of otherwise benign pieces of code (gadgets), which inadvertently read from attacker-controlled properties to execute security-sensitive operations. While prior works primarily study gadgets in third-party libraries and client-side applications, gadgets in JavaScript runtime environments are arguably more impactful as they affect any application that executes on these runtimes. In this paper we design, implement, and evaluate a pipeline, GHunter, to systematically detect gadgets in V8-based JavaScript runtimes with prime focus on…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsMobile and Web Applications · Energy Efficiency in Computing · Scientific Computing and Data Management
