[Paper Review] Code-based Vulnerability Detection in Node.js Applications: How far are we?

Bodin Chinthanet, Serena Elisa Ponta+5 more|arXiv (Cornell University)|Aug 11, 2020

Advanced Malware Detection Techniques10 references4 citations

TL;DR

This paper presents a code-centric vulnerability detection approach for Node.js applications, extending Eclipse-Steady to analyze JavaScript constructs in npm dependencies. It successfully detects vulnerable code in 18 of 65 SAP-developed applications, identifying five known vulnerabilities through static analysis of modified program constructs, demonstrating the viability of static analysis in dynamic JavaScript environments.

ABSTRACT

With one of the largest available collection of reusable packages, the JavaScript runtime environment Node.js is one of the most popular programming application. With recent work showing evidence that known vulnerabilities are prevalent in both open source and industrial software, we propose and implement a viable code-based vulnerability detection tool for Node.js applications. Our case study lists the challenges encountered while implementing our Node.js vulnerable code detector.

Motivation & Objective

• To address the limitations of meta-detection in npm vulnerability detection, which relies on incomplete or inaccurate metadata.
• To develop a code-centric approach that identifies actual vulnerable code constructs in Node.js applications, reducing false positives and negatives.
• To evaluate the feasibility of applying static analysis techniques to JavaScript's dynamic, event-driven codebase.
• To understand the challenges in constructing a bill of materials (BoM) for Node.js applications and detecting vulnerable constructs across dependency levels.
• To provide insights and lessons for researchers and practitioners on improving vulnerability detection in the evolving npm ecosystem.

Proposed method

• Extending the Eclipse-Steady framework to support JavaScript by defining a hierarchical construct model (Package, Module, Function, Class, Method, Constructor, Object) for program analysis.
• Extracting and analyzing program constructs modified in patches to identify vulnerable code patterns in npm dependencies.
• Constructing a bill of materials (BoM) for Node.js applications to map dependencies and their constructs, distinguishing between direct and transitive dependencies.
• Using static analysis to detect whether vulnerable constructs (e.g., methods, functions) are present and reachable in application code.
• Applying the approach to a case study of 65 SAP-developed Node.js applications to evaluate detection accuracy and performance.
• Evaluating detection at different abstraction levels (e.g., MODU, FUNC, OBJT) to assess granularity trade-offs.

Experimental results

Research questions

• RQ1 Can a code-centric approach effectively detect known vulnerabilities in Node.js applications by analyzing actual code constructs rather than relying on metadata?
• RQ2 What are the key challenges in constructing a bill of materials and detecting vulnerable constructs in JavaScript's dynamic, prototype-based model?
• RQ3 How effective is static analysis in identifying vulnerable code patterns in event-driven, asynchronous Node.js applications?
• RQ4 To what extent are transitive dependencies responsible for introducing vulnerable code, and how can they be better tracked?
• RQ5 What are the practical implications and limitations of applying existing static analysis techniques to modern JavaScript and npm ecosystems?

Key findings

• The code-centric approach successfully detected five known vulnerabilities in 18 out of 65 SAP-developed Node.js applications, demonstrating the viability of static analysis in JavaScript environments.
• Most vulnerable constructs were found in transitive dependencies (28 runtime, 27 test), indicating that developers often lack visibility into indirect dependencies.
• The majority of vulnerable constructs were detected at the module (MODU) and function (FUNC) levels, suggesting that fine-grained object (OBJT) and constructor (CONS) analysis may not be necessary for initial detection.
• The study revealed that 681 vulnerabilities were reported in the npm ecosystem as of 2019, highlighting the scale of the problem and the need for better detection mechanisms.
• The approach faced challenges in mapping JavaScript’s multiple function declaration styles and prototype-based inheritance, indicating a need for enhanced language modeling.
• The results show that static analysis tools must evolve to keep pace with ECMAScript’s annual updates and Node.js’s rapid evolution to maintain accuracy and relevance.