SaTC: CORE: Small: Studying and Measuring the Consequence of Prototype Pollution Vulnerabilities Automatically via Joint Taintflow Analysis

原型污染是2018年发现的一种相对较新的脆弱性。现有的研究成果都集中在原型污染本身，而不是后续影响，我们称之为进一步的后果。虽然人们知道原型污染可能会导致一些后果，如严重的变量，但仍然不清楚可能的后果清单是什么，更重要的是，它们在真实的世界中有多普遍。这极大地限制了人们对原型污染的理解：他们通常不认真对待原型污染，因为他们认为这是一个“理论”漏洞，可能不会像其他Web漏洞那样产生严重后果。在本项目中，设计了一个新的联合污染流分析自动化框架，以系统地研究和测量原型污染漏洞在真实的世界中的进一步后果。具体来说，这种分析基于对象查找和赋值语句连接不同的污染流。该项目将回答原型污染中的三个基本问题，即，(i)在何处注入/改变属性，（ii）污染什么属性，以及（iii）注入什么值。例如，跨站点脚本（XSS）的结果取决于问题（iii）的答案和相应的联合污染流：污点进入属于作为途中停靠站的污染对象的污染属性的值，该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识产权进行评估来支持。优点和更广泛的影响审查标准。

Prototype pollution is a relatively new type of vulnerability that was discovered in 2018. State-of-the-art works all focus on prototype pollution itself but not the follow-up influence, which we call further consequences in this project. Although people understand that prototype pollution may lead to some consequences such as overwriting critical variables, it remains unclear what a list of possible consequences could be and more importantly how prevalent they are in the real world. This greatly limits people’s understanding of prototype pollution: They often do not take prototype pollution seriously because they think it is a "theoretical" vulnerability, which may not have a severe consequence as other web vulnerabilities.In this project, an automated framework on a novel joint taint-flow analysis is designed to systematically study and measure further consequences of prototype pollution vulnerabilities in the real world. Specifically, such an analysis connects different taint-flows based on object lookup and assignment statements. The project will answer three fundamental questions in prototype pollution, i.e., (i) where to inject/alter a property, (ii) what property to pollute, and (iii) what value to inject. For example, a Cross-site Scripting (XSS) consequence depends on the answer to the question (iii) and the corresponding joint taint-flow: The taint goes into the value of a polluted property belonging to a polluted object as an en-route stop, and then finally to a traditional XSS sink like eval.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.