Conference:  Black Hat Asia 2023

Authors: Mikhail Shcherbakov

2023-05-11

Many have heard about Prototype Pollution vulnerabilities in JavaScript applications. This kind of vulnerability allows an attacker to inject properties into an object's root prototype that may lead to flow control alteration and unexpected program behavior. Every time a successful exploit looks like magic or is limited to a denial of service (DoS). Would you be surprised if I told you that every application has a chain of methods that can be triggered by Prototype Pollution and leads to arbitrary code execution? Such gadgets populated Node.js core code and popular NPM packages. Keep calm. Not every app can be exploited! However, this fact increases the risk of exploitation many times over.In our research, we studied Prototype Pollution beyond DoS and analyzed Node.js source code against the gadgets. We then analyzed 15 popular Node.js apps from GitHub and got 8 RCEs. Through this talk, I will elaborate on the detected gadgets and vulnerabilities. We will also take a look at how the recent changes in Node.js mitigate these issues.

Conference:  OWASP 20th Anniversary Event

Authors: Joseph Feiman

2021-09-24

The main idea of the conference presentation is that traditional application security technologies are not sufficient for modern DevSecOps requirements and that specially designed technologies are needed to enable DevSecOps.

• Technology is the basis for culture, not the other way around
• Existing traditional security technologies are not designed for DevSecOps and cannot fulfill modern requirements
• Automation of specially designed technologies is necessary for DevSecOps
• DevSecOps technologies should be built for the DevOps community and be application architecture agnostic
• DevSecOps technologies should be fully automated and provide insight into tested application behavior
• Adopting technology specifically built for DevSecOps is necessary for success