Effective Fuzzing-based Prototype Pollution Detection via Forced Execution and Template Synthesis

Prototype pollution is a critical class of taint-style vulnerabilities in JavaScript programs, enabling attackers to tamper with object prototypes and thereby alter program behavior in unexpected and often dangerous ways. Despite its severity, existing detection techniques struggle with excessive false positives and poor scalability.

In this work, we present

, a lightweight fuzzing-based approach that integrates both forced execution based dynamic analysis and template-based exploit generation to effectively detect prototype pollution vulnerabilities and generate working exploits. enables better flexibility and scalability and avoids imprecise modeling of JavaScript syntax in static analysis.

Our evaluation of curated benchmarks and real-world Node.js packages shows that

identifies more vulnerabilities than prior approaches, including , , , and . Specifically, on the benchmark of known vulnerabilities from prior works, can identify 228 out of 238 vulnerabilities and generate working exploits for them. also discovers 24 zero-day vulnerabilities between over 60k popular packages collected from npm registry. Additionally, compared to and , demonstrates better scalability by mitigating time-out for many packages.