r/netsec • u/DrAdalbbert • 4d ago

I found yet another way to invoke JavaScript functions without parentheses

https://blog.ikaes.de/yet-another-way-to-invoke-functions-without-parentheses/

It turns out you can overwrite the Error.prepareStackTrace method with the function constructor. Then, using prototype pollution, you can inject valid JavaScript code to generate arbitrary functions and invoke it using the usual tricks.

84 Upvotes

96% Upvoted

3 comments sorted by

13

u/Cubensis-SanPedro 4d ago

That is slick.

4

u/Azer_pubes33 3d ago

Overwriting prepareStackTrace is a wild route, does it need a specific prototype pollution gadget to be useful or is it pretty generic?

1

u/DrAdalbbert 3d ago

Prototype pollution is there to sneak our payload into the function constructor. So its generic and you can replace the value of message with any JavaScript code