{"id":"https://openalex.org/W4385080345","doi":"https://doi.org/10.1109/sp46215.2023.10179352","title":"Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability","display_name":"Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability","publication_year":2023,"publication_date":"2023-05-01","ids":{"openalex":"https://openalex.org/W4385080345","doi":"https://doi.org/10.1109/sp46215.2023.10179352"},"language":"en","primary_location":{"id":"doi:10.1109/sp46215.2023.10179352","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179352","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077261137","display_name":"Mingqing Kang","orcid":"https://orcid.org/0009-0004-9476-9247"},"institutions":[{"id":"https://openalex.org/I145311948","display_name":"Johns Hopkins University","ror":"https://ror.org/00za53h95","country_code":"US","type":"education","lineage":["https://openalex.org/I145311948"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mingqing Kang","raw_affiliation_strings":["Johns Hopkins University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Johns Hopkins University","institution_ids":["https://openalex.org/I145311948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111149883","display_name":"Yichao Xu","orcid":null},"institutions":[{"id":"https://openalex.org/I145311948","display_name":"Johns Hopkins University","ror":"https://ror.org/00za53h95","country_code":"US","type":"education","lineage":["https://openalex.org/I145311948"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yichao Xu","raw_affiliation_strings":["Johns Hopkins University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Johns Hopkins University","institution_ids":["https://openalex.org/I145311948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100448208","display_name":"Song Li","orcid":"https://orcid.org/0000-0002-7961-8502"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Song Li","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051819817","display_name":"Rigel Gjomemo","orcid":"https://orcid.org/0009-0001-3715-077X"},"institutions":[{"id":"https://openalex.org/I39422238","display_name":"University of Illinois Chicago","ror":"https://ror.org/02mpq6x41","country_code":"US","type":"education","lineage":["https://openalex.org/I39422238"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Rigel Gjomemo","raw_affiliation_strings":["University of Illinois Chicago"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois Chicago","institution_ids":["https://openalex.org/I39422238"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036723604","display_name":"Jianwei Hou","orcid":"https://orcid.org/0000-0001-5503-8143"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jianwei Hou","raw_affiliation_strings":["Remain University of China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Remain University of China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058117020","display_name":"V. N. Venkatakrishnan","orcid":"https://orcid.org/0000-0002-1690-9185"},"institutions":[{"id":"https://openalex.org/I39422238","display_name":"University of Illinois Chicago","ror":"https://ror.org/02mpq6x41","country_code":"US","type":"education","lineage":["https://openalex.org/I39422238"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"V. N. Venkatakrishnan","raw_affiliation_strings":["University of Illinois Chicago"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois Chicago","institution_ids":["https://openalex.org/I39422238"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070605476","display_name":"Yinzhi Cao","orcid":"https://orcid.org/0000-0002-9618-4830"},"institutions":[{"id":"https://openalex.org/I145311948","display_name":"Johns Hopkins University","ror":"https://ror.org/00za53h95","country_code":"US","type":"education","lineage":["https://openalex.org/I145311948"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yinzhi Cao","raw_affiliation_strings":["Johns Hopkins University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Johns Hopkins University","institution_ids":["https://openalex.org/I145311948"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.6948,"has_fulltext":false,"cited_by_count":16,"citation_normalized_percentile":{"value":0.96790072,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1059","last_page":"1076"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8763078451156616},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6396560072898865},{"id":"https://openalex.org/keywords/abstract-interpretation","display_name":"Abstract interpretation","score":0.6106235384941101},{"id":"https://openalex.org/keywords/taint-checking","display_name":"Taint checking","score":0.5964978933334351},{"id":"https://openalex.org/keywords/javascript","display_name":"JavaScript","score":0.585265040397644},{"id":"https://openalex.org/keywords/identifier","display_name":"Identifier","score":0.5088965892791748},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.48820143938064575},{"id":"https://openalex.org/keywords/node","display_name":"Node (physics)","score":0.46554362773895264},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.46116796135902405},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.45884689688682556},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.3558841943740845},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3388245105743408},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.22466152906417847},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.15114426612854004}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8763078451156616},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6396560072898865},{"id":"https://openalex.org/C2780654840","wikidata":"https://www.wikidata.org/wiki/Q333341","display_name":"Abstract interpretation","level":2,"score":0.6106235384941101},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.5964978933334351},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.585265040397644},{"id":"https://openalex.org/C154504017","wikidata":"https://www.wikidata.org/wiki/Q853614","display_name":"Identifier","level":2,"score":0.5088965892791748},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.48820143938064575},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.46554362773895264},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.46116796135902405},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.45884689688682556},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3558841943740845},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3388245105743408},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.22466152906417847},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.15114426612854004},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0},{"id":"https://openalex.org/C66938386","wikidata":"https://www.wikidata.org/wiki/Q633538","display_name":"Structural engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sp46215.2023.10179352","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179352","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.6800000071525574}],"awards":[],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":75,"referenced_works":["https://openalex.org/W202191487","https://openalex.org/W1563577331","https://openalex.org/W1965194038","https://openalex.org/W1966862293","https://openalex.org/W1987647365","https://openalex.org/W1991074244","https://openalex.org/W1992114977","https://openalex.org/W2005476560","https://openalex.org/W2012578421","https://openalex.org/W2027625187","https://openalex.org/W2039524325","https://openalex.org/W2055931054","https://openalex.org/W2060218972","https://openalex.org/W2080298145","https://openalex.org/W2094568767","https://openalex.org/W2132122456","https://openalex.org/W2157820337","https://openalex.org/W2188710721","https://openalex.org/W2293624369","https://openalex.org/W2401455848","https://openalex.org/W2401831929","https://openalex.org/W2536013516","https://openalex.org/W2591793539","https://openalex.org/W2612608334","https://openalex.org/W2620797757","https://openalex.org/W2732351623","https://openalex.org/W2735438339","https://openalex.org/W2752602409","https://openalex.org/W2765755114","https://openalex.org/W2790761820","https://openalex.org/W2800651024","https://openalex.org/W2882992559","https://openalex.org/W2885626945","https://openalex.org/W2901089484","https://openalex.org/W2901936332","https://openalex.org/W2912230492","https://openalex.org/W2916390297","https://openalex.org/W2966386960","https://openalex.org/W2967904600","https://openalex.org/W2970044827","https://openalex.org/W2970323597","https://openalex.org/W3015975623","https://openalex.org/W3095708133","https://openalex.org/W3102356356","https://openalex.org/W3117175757","https://openalex.org/W3131584678","https://openalex.org/W3136860402","https://openalex.org/W3138230581","https://openalex.org/W3155666085","https://openalex.org/W3164306598","https://openalex.org/W3165028596","https://openalex.org/W3180903877","https://openalex.org/W3187895569","https://openalex.org/W3194926883","https://openalex.org/W3196199748","https://openalex.org/W3204945378","https://openalex.org/W3212674443","https://openalex.org/W4225999506","https://openalex.org/W4226183854","https://openalex.org/W4233177776","https://openalex.org/W4247387602","https://openalex.org/W4288043239","https://openalex.org/W4312903035","https://openalex.org/W4324007143","https://openalex.org/W6713329725","https://openalex.org/W6740380446","https://openalex.org/W6752006691","https://openalex.org/W6754216381","https://openalex.org/W6760925213","https://openalex.org/W6766571157","https://openalex.org/W6783996346","https://openalex.org/W6790654816","https://openalex.org/W6790784923","https://openalex.org/W6795482521","https://openalex.org/W6841065762"],"related_works":["https://openalex.org/W17155033","https://openalex.org/W3207760230","https://openalex.org/W1496222301","https://openalex.org/W1590307681","https://openalex.org/W2536018345","https://openalex.org/W4312814274","https://openalex.org/W2007597182","https://openalex.org/W2368911326","https://openalex.org/W2137424589","https://openalex.org/W4313563662"],"abstract_inverted_index":{"Taint-style":[0],"vulnerabilities,":[1],"such":[2,28,209,215],"as":[3,210,216],"OS":[4],"command":[5],"injection":[6],"and":[7,12,24,104,132,159,172,212,218],"path":[8,147,158],"traversal,":[9],"are":[10],"common":[11],"severe":[13],"software":[14],"weaknesses.":[15],"There":[16],"exists":[17],"an":[18,144],"inherent":[19],"trade-off":[20],"between":[21],"analysis":[22,41],"scalability":[23,71],"accuracy":[25,42],"in":[26,39,63,190,220],"detecting":[27],"vulnerabilities.":[29],"On":[30,49],"one":[31],"hand,":[32,52],"existing":[33,53],"syntax-directed":[34],"approaches":[35],"often":[36,56],"make":[37],"compromises":[38],"the":[40,50,58,64,84,126,134,141,152,157,161],"on":[43,98,114],"dynamic":[44,122],"features":[45],"like":[46],"bracket":[47],"syntax.":[48],"other":[51],"abstract":[54,65,93,106],"interpretation":[55,94],"faces":[57],"issue":[59],"of":[60,87,117,154,170],"state":[61],"explosion":[62],"domain,":[66],"thus":[67],"leading":[68],"to":[69,82,120,136,140,163,185,206],"a":[70,77,91,168],"problem.In":[72],"this":[73],"paper,":[74],"we":[75],"present":[76],"novel":[78,92],"approach,":[79],"called":[80,102],"FAST,":[81],"scale":[83,205],"vulnerability":[85],"discovery":[86],"JavaScript":[88],"packages":[89],"via":[90],"approach":[95],"that":[96,181,202,224],"relies":[97],"two":[99],"new":[100],"techniques,":[101],"bottom-up":[103],"top-down":[105],"interpretation.":[107],"The":[108],"former":[109],"abstractly":[110],"interprets":[111],"functions":[112],"based":[113],"scopes":[115],"instead":[116],"call":[118,123],"sequences":[119],"construct":[121],"edges.":[124],"Then,":[125],"latter":[127],"follows":[128],"specific":[129],"control-flow":[130],"paths":[131],"prunes":[133],"program":[135],"skip":[137],"statements":[138],"unrelated":[139],"sink.":[142],"If":[143],"end-to-end":[145],"data-flow":[146],"is":[148,183],"found,":[149],"FAST":[150,171,182,203],"queries":[151],"satisfiability":[153],"constraints":[155],"along":[156],"verifies":[160],"exploitability":[162],"reduce":[164],"human":[165],"efforts.We":[166],"implement":[167],"prototype":[169],"evaluate":[173],"it":[174],"against":[175],"real-world":[176,207],"Node.js":[177],"packages.":[178],"We":[179],"show":[180],"able":[184],"find":[186],"242":[187],"zero-day":[188],"vulnerabilities":[189,223],"NPM":[191],"with":[192],"21":[193],"CVE":[194],"identifiers":[195],"being":[196],"assigned.":[197],"Our":[198],"evaluation":[199],"also":[200],"shows":[201],"can":[204],"applications":[208],"NodeBB":[211],"popular":[213],"frameworks":[214],"total.js":[217],"strapi":[219],"finding":[221],"legacy":[222],"no":[225],"prior":[226],"works":[227],"can.":[228]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":6}],"updated_date":"2026-07-01T08:55:40.977307","created_date":"2025-10-10T00:00:00"}