  For better or worse, JavaScript is the cornerstone of modern Web.
Prototype-based languages like JavaScript are susceptible to prototype
pollution vulnerabilities, enabling an attacker to inject arbitrary properties
into an object's prototype. The attacker can subsequently capitalize on the
injected properties by executing otherwise benign pieces of code, so-called
gadgets, that perform security-sensitive operations. The success of an attack
largely depends on the presence of gadgets, leading to high-profile exploits
such as privilege escalation and arbitrary code execution (ACE).
  This paper proposes Dasty, the first semi-automated pipeline to help
developers identify gadgets in their applications' software supply chain. Dasty
targets server-side Node.js applications and relies on an enhancement of
dynamic taint analysis which we implement with the dynamic AST-level
instrumentation. Moreover, Dasty provides support for visualization of code
flows with an IDE, thus facilitating the subsequent manual analysis for
building proof-of-concept exploits. To illustrate the danger of gadgets, we use
Dasty in a study of the most dependent-upon NPM packages to analyze the
presence of gadgets leading to ACE. Dasty identifies 1,269 server-side
packages, of which 631 have code flows that may reach dangerous sinks. We
manually prioritize and verify the candidate flows to build proof-of-concept
exploits for 49 NPM packages, including popular packages such as ejs,
nodemailer and workerpool. To investigate how Dasty integrates with existing
tools to find end-to-end exploits, we conduct an in-depth analysis of a popular
data visualization dashboard to find one high-severity CVE-2023-31415 leading
to remote code execution. For the first time, our results systematically
demonstrate the dangers of server-side gadgets and call for further research to
solve the problem.
