Node.js Security Flaws - JavaScript bugs aplenty in Node.js ecosystem

guest · Sep 3, 2022

Academics Devise Open Source Tool For Hunting Node.js Security Flaws
By Ionut Arghire - August 30, 2022

A group of academic researchers have designed an open source Node.js bug hunting tool that has already identified 180 security vulnerabilities.

Node.js is an open-source, cross-platform, environment for running JavaScript code outside the browser. It was designed for the development of network applications. While useful, many of the available Node.js packages contain unknown flaws leading to application compromise.
Click to expand...

Now, academics from the Johns Hopkins University and Renmin University of China propose a new approach to finding security vulnerabilities in Node.js packages.

Inspired by the graph query-based approaches such as Code Property Graph (CPG), the researchers devised a novel graph structure called Object Dependence Graph (ODG), and also built an open-source prototype system called ‘ODGEN’, to use ODG for bug hunting.

“Specifically, ODG includes fine-grained data dependencies between objects, thus helping taint-style vulnerability detection such as command injection,” according to a research paper (.pdf) documenting the work.
Click to expand...

The researchers were able to configure ODGEN to identify six types of vulnerabilities, which has led to the discovery of “43 application-level zero-day vulnerabilities with 14 false positives and we also confirmed 137 package-level zero-day vulnerabilities with 84 false positives”.

A total of 70 Common Vulnerabilities and Exposures (CVE) identifiers have been issued for the identified security bugs.
Click to expand...

Mining Node.js Vulnerabilities via Object Dependence Graph and Query

Node.js is a popular non-browser JavaScript platform that provides useful but sometimes also vulnerable packages. On one hand, prior works have proposed many program analysis-based approaches to detect Node.js vulnerabilities, such as command injection and prototype pollution, but they are specific to individual vulnerability and do not generalize to a wide range of vulnerabilities on Node.js.

On the other hand, prior works on C/C++ and PHP have proposed graph query-based approaches, such as Code Property Graph (CPG), to efficiently mine vulnerabilities, but they are not directly applicable to JavaScript due to the language's extensive use of dynamic features.
Click to expand...

In the paper, we propose flow- and context-sensitive static analysis with hybrid branch-sensitivity and points-to information to generate a novel graph structure, called Object Dependence Graph (ODG), using abstract interpretation. ODG represents JavaScript objects as nodes and their relations with Abstract Syntax Tree (AST) as edges, and accepts graph queries—especially on object lookups and definitions—for detecting Node.js vulnerabilities.
Click to expand...

Log in or Sign up

Node.js Security Flaws - JavaScript bugs aplenty in Node.js ecosystem

guest Guest

Log in or Sign up

Node.js Security Flaws - JavaScript bugs aplenty in Node.js ecosystem

guest Guest

Useful Searches