Executing JavaScript Functions Without Parentheses via Error Objects
A novel technique leveraging stack trace manipulation to bypass standard function invocation syntax.
1Exploiting Error Object Mechanics
The technique centers on the Error object's prepareStackTrace function, typically used for formatting stack traces. By overwriting this specific function, an attacker can intercept the structured representation of code positions. This mechanism triggers automatically when the stack attribute of an error is accessed, providing a unique entry point for arbitrary code execution.
2Function Constructor Signature Alignment
The prepareStackTrace function shares a signature with the JavaScript Function constructor. By manipulating the second argument, which represents code positions, one can generate new functions. However, since stack traces are arrays rather than valid executable code, the generated function initially throws a syntax error, necessitating further manipulation of the output structure.
3Controlling Array Prototype toString
To convert the array of code positions into a valid JavaScript payload, the Array.prototype.toString function must be controlled. One approach involves overwriting this prototype with a constant function that returns the desired payload. This transformation ensures that the stack trace representation is interpreted as executable code rather than an array object.
4Leveraging Prototype Pollution Techniques
Prototype pollution provides an alternative method to inject payloads by manipulating Object.prototype.message. By staying within the Error realm and modifying the toString function, an attacker can effectively sneak the payload into the execution flow. This method demonstrates how deep prototype modifications can bypass standard security checks during the function generation process.
5Invoking Functions via ValueOf Trick
Once the function is generated, it must be invoked without standard parentheses. The valueOf trick achieves this by overwriting the default valueOf function of an object. When the object is subsequently invoked as a primitive, the custom logic executes, effectively bypassing the traditional requirement for parentheses in standard JavaScript function call syntax.
6Alternative Invocation via Concatenation
Beyond the valueOf method, developers can utilize the toString function to trigger execution. By concatenating the object with a string, the engine forces a type conversion that executes the payload. This flexibility highlights multiple pathways for invocation, proving that standard syntax constraints are not absolute barriers when prototype manipulation is successfully applied.
7Security Implications of Prototype Manipulation
This research underscores the inherent risks associated with prototype pollution in JavaScript environments. When core objects like Error or Array are modified, the entire execution context becomes vulnerable to arbitrary code injection. Developers should be cautious when implementing custom stack trace handlers or allowing external input to influence object prototypes during runtime.
8Future Defense Against Injection
Mitigating these vulnerabilities requires strict control over prototype modifications and the use of frozen objects where possible. As attackers find increasingly creative ways to bypass syntax constraints, security audits must focus on how objects interact with built-in constructors. Understanding these low-level execution tricks is essential for building robust, secure JavaScript applications today.
Original article: Hacker News — Executing JavaScript Functions Without Parentheses via Error Objects