writeups.xyz / Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js

Submitter : c2a

Date: 11 November 2022

Bounty : undisclosed

Vulnerabilities :

• RCE
• Prototype Pollution
• DoS

Programs :

• Rocket.Chat
• NPM CLI
• Parse Server
• Node.js

Authors :

• Mikhail Shcherbakov
• Musard Balliu
• Cristian-Alexandru Staicu

Link :
https://www.usenix.org/system/files/sec23summer_432-shcherbakov-prepub.pdf