Discovering Hidden Properties to Attack Node.js Ecosystem
Feng Xiao presents Hidden Property Abusing (HPA), a novel attack vector exploiting internal Node.js runtime properties to achieve arbitrary code execution.
Summary
The Ubiquity of Node.js in Server and Desktop Applications
Node.js provides a cross-platform runtime for JavaScript, executing critical server-side APIs, cloud microservices, and desktop Electron applications.
Introducing Hidden Property Abusing (HPA)
Feng Xiao introduces Hidden Property Abusing (HPA), an attack technique that leverages internal, undocumented object properties and engine built-ins exposed by Node.js.
Manipulating Application Control Flow and Memory
By manipulating hidden properties in popular NPM frameworks, an attacker can alter runtime logic, bypass authentication checks, and chain execution gadgets to RCE.
Defending JavaScript Runtimes Against Property Manipulation
The author provides defensive coding patterns and automated scanning tools to detect hidden property exposure in open-source JavaScript codebases.
Related talks
Main Stage·20 min
Mikhail Shcherbakov · Musard Balliu
Mikhail Shcherbakov and Musard Balliu uncover universal Prototype Pollution gadgets within Node.js core and popular NPM packages, achieving RCE across major applications.
Main Stage·31 min
Feng Xiao
Feng Xiao answers audience questions on Hidden Property Abusing (HPA), JavaScript runtime internals, and securing NPM libraries.
Main Stage·46 min
Mikhail Shcherbakov
Advanced JavaScript and TypeScript exploit primitives turning theoretically unexploitable flaws in Kibana into working code execution.