New prototype pollution technique enables JavaScript execution without parentheses

A security researcher has identified a new method for invoking JavaScript functions without using parentheses, a technique that could potentially bypass certain security controls designed to block such syntax. The discovery, posted to the r/netsec subreddit by user DrAdalbbert, demonstrates how attackers can leverage prototype pollution to execute arbitrary code in environments where standard function calls are restricted.

The core of this technique involves overwriting the `Error.prepareStackTrace` method with the `Function` constructor. By manipulating this specific property, an attacker can generate arbitrary functions dynamically. According to the report, this setup allows for the injection of valid JavaScript code through prototype pollution. Once the code is injected, the attacker can invoke the generated functions using existing tricks that do not require the use of parentheses, effectively circumventing restrictions that target that specific character sequence.

Context and Background

JavaScript security mechanisms often rely on sanitizing input or restricting the execution context to prevent cross-site scripting (XSS) and other injection attacks. One common mitigation strategy is to block the use of parentheses, as they are required for calling most functions in JavaScript. By preventing the use of `()`, defenders aim to stop attackers from executing functions like `alert()` or `document.cookie`.

However, the method described by DrAdalbbert shows that this mitigation is not foolproof. The `Error.prepareStackTrace` property is a hook that allows custom formatting of stack traces. By replacing this hook with the `Function` constructor, the attacker gains the ability to compile and execute strings as code. This bypasses the need for parentheses because the execution flow is triggered through the stack trace mechanism itself, rather than a direct function call syntax.

Prototype pollution is a vulnerability class where an attacker can modify the prototype of a built-in JavaScript object, such as `Object.prototype`. This allows the attacker to add or modify properties that are inherited by all objects in the application. In this scenario, prototype pollution is used to inject the necessary code into the environment, which is then executed via the manipulated `Error.prepareStackTrace` method.

Who Is Affected

Any web application or JavaScript environment that relies on blocking parentheses as a primary defense against code injection may be vulnerable to this technique. This includes server-side JavaScript environments like Node.js, as well as client-side applications that use strict input sanitization rules. The vulnerability is particularly relevant for applications that have not implemented more robust sandboxing or allow-listing strategies for code execution.

The technique does not require a specific CVE or a known vulnerability in a particular library. Instead, it exploits the inherent flexibility of the JavaScript language and its prototype-based inheritance model. As such, it is a general-purpose bypass that can be applied to any JavaScript runtime where the attacker can achieve prototype pollution and manipulate the `Error` object.

What should you do?

Security teams should review their JavaScript security controls to ensure they are not relying solely on blocking parentheses to prevent code execution. Organizations should monitor for signs of prototype pollution attacks, such as unexpected properties appearing on objects or unusual stack trace behavior.

What to do and how to stay safe: JavaScript

• Audit JavaScript code for instances where `Error.prepareStackTrace` is accessible or modifiable by user input.
• Implement strict allow-lists for executable code rather than relying on block-lists for specific characters like parentheses.
• Monitor application logs for anomalous prototype pollution attempts, such as unexpected modifications to `Object.prototype`.
• Ensure that input sanitization libraries are updated to handle novel bypass techniques involving stack trace manipulation.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the specific vulnerability identified in this report?

The report identifies a technique to invoke JavaScript functions without parentheses by overwriting Error.prepareStackTrace with the Function constructor and using prototype pollution.

Who discovered this method?

The method was discovered and shared by Reddit user DrAdalbbert on the r/netsec subreddit.

Does this require a specific CVE or software bug?

No, this is a general technique that exploits JavaScript language features and prototype pollution, rather than a specific CVE in a software product.