Undefined-oriented Programming: Detecting and Chaining Prototype Pollution Gadgets in Node.js Template Engines for Malicious Consequences

Presented at IEEE Symposium on Security and Privacy 2024 by

Yinzhi Cao

Zhengyu Liu

Kecheng An