Later archive addition

Abusing Hidden Properties to Attack the Node.js Ecosystem

Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu and Wenke Lee

Hidden property abusing exploits the gap between how client-supplied objects are serialised and how server code reads them, letting a remote attacker inject internal object properties the developer never meant to expose.

Record

Researcher

Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu and Wenke Lee

In the archive

• Added to the 2021 archive after the original list was published

Related sources

• Talk recording
• Talk recording
• Talk recording

Tags

• prototype-pollution
• mass-assignment
• injection
• auth-bypass
• info-leak
• dos
• nodejs
• javascript
• static-analysis
• tooling
• owasp-a01-2021
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu and Wenke Lee, first published at the original source. Preserved copies are kept so the citation survives its host.