This repository contains a tool to generate proof-of-concept exploits for vulnerable npm packages.

1. Clone the repository:

$ git clone https://github.com/sola-st/PoCGen

2. Install dependencies:

$ cd PoCGen
$ npm install

3. Build the docker images:

$ docker build -t patched_node -f patched_node.Dockerfile .
$ docker build -t gen-poc_mnt .

The repository contains a wrapper script to run the tool in a docker container. The script requires an .env file in the current directory with the following content:

OPENAI_API_KEY=sk-proj-xxx
GITHUB_API_KEY=github_pat_xxx # required for fetching GHSA-IDs

The only required argument is the vulnerability ID, which should be a GitHub Advisory ID or a Snyk ID. The tool will automatically fetch the vulnerability report from the corresponding API/ scrape it from the website.

Run this script from the repository root:

$ ./run-mnt.sh output node index.js create -v GHSA-m7p2-ghfh-pjvx

This will create a test for GHSA-m7p2-ghfh-pjvx in ./output/GHSA-m7p2-ghfh-pjvx/test.js.

For most vulnerabilities, it is recommended to run the test using the provided docker image:

$ ./run-mnt.sh output node --test /output/<advisoryId>/test.js

For ReDoS vulnerabilities, the test should be run with the following flags:

./run-mnt.sh output node --test --enable-experimental-regexp-engine-on-excessive-backtracks --regexp-backtracks-before-fallback=30000 output/<advisoryId>/test.js

For vulnerabilities that involve long-running tasks (e.g. web servers), run the test with the following flags:

$ ./run-mnt.sh output node --test --test-force-exit /output/<advisoryId>/test.js

First, follow the installation instructions above.

$ ./run-mnt.sh output node index.js pipeline -v dataset/SecBench.js/*\.all

Note that in our experiments, the approach was run twice (without caching prompts).

The following table shows the different refiner configurations and which components are enabled or disabled.

A refiner can be specified using --refiner <refiner>, where <refiner> is one of the following values: C0Refiner, C1Refiner, C2Refiner, C3Refiner, C4Refiner.

To reproduce the results for RQ3, run the following command:

$ ./run-mnt.sh output node index.js pipeline -v dataset/SecBench.js/*\.all