Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Node.js. Show all posts
Vulnerabilities and Exploits
API Data Sever Node.js RCE Vulnerabilities and Exploits

Prototype Bug in Blitz.js. Allows RCE on Node.js Servers

 

Blitz.js, a JavaScript web online framework, has issued a patch for a critical prototype pollution bug to prevent remote code execution (RCE) on Node.js servers. 

Prototype pollution is a specific kind of JavaScript vulnerability that allows hackers to manipulate the structure of the programming language and exploit it in multiple ways, Paul Gerste, security researcher at Sonar explained. It also allowed hackers to exploit the code in the Blitz.js app to design a reverse shell and run arbitrary commands on the server. 

Blitz is designed on top of Next.js, a React-based framework, and adds components to turn it into a full-stack web development platform. One of the popular components of Blitz.js is its ‘Zero-API’ layer, which allows the customer to employ specific functions to call server-side business logic without having to design API code. 

Additionally, it makes an RPC call to the server in the background and returns the response to the client function call. Gerste identified a chain of exploits that could be exploited via the prototype pollution bug and lead to RCE. 

The attackers target Node.js by sending a JSON request, a browser service that enables two-way data exchange with any JSON data server without exposing users’ data, to the server, which triggers the routing function of Blitz.js to load a JavaScript file with the polluted prototype. This allows the hacker to employ the malicious JavaScript object to implement arbitrary code. 

In an ideal scenario, the hacker would design and run a file on the server. But Blitz.js does not support upload functionality. However, it has a CLI wrapper script that uses JavaScript’s spawn() function to launch a new process. 

The attacker could use this function to launch a CLI process and run an arbitrary command on the server. The vulnerability can be triggered without any authentication, which means any user who can access the Blitz.js application will be able to launch RCE attacks.  

“This attack technique leverages a code pattern that isn’t a vulnerability in itself,” Gerste explained. “Prototype pollution can influence the target application in a very invasive way, and it would require a lot of work to get rid of all code that could be influenced by prototype pollution.” 

In his blog post, the researcher mentioned some general recommendations to safeguard JavaScript apps against prototype pollution, including freezing 'object.prototype or using the --disable-proto=delete flag in Node.js

“I think prototype pollution is still unknown to many JavaScript developers,” Gerste added. “I don’t see developers often use the patterns that we recommended in our article. With our blog posts, we try to help educate JavaScript developers and share this knowledge.”
Read more »
Vulnerability and Exploits
Node.js patch fixes Security Patch Vulnerabilities and Exploits Vulnerability and Exploits

Node.js Patches Various Flaws that may Lead to Attacks

About vulnerabilities

Node.js maintainers released multiple patches for flaws in the JavaScript runtime environment that can cause HTTP request smuggling and arbitrary code execution, among some other attacks. An advisory mentions the information about the seven patched bugs, it includes three seperate HTTP Request Smuggling vulnerabilities. 

The three flaws- a flawed parsing of transfer-encoding bug, tracked as CVE-2022-32213, an errored delimiting of header fields issue, tracked as CVE-2022-32214, and an improper parsing of multi-line transfer encoding exploit, tracked as CVE-2022-32215, can all in the end lead towards HTTP request smuggling. 

The Daily Swig says "the moderate-severity implementation bug (CVE-2022-2097) could cause encryption to fail in some circumstances. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data, which could reveal sixteen bytes of data that was pre-existing in the memory that wasn’t written." 

How Severe are these bugs?

The three bugs were rated as "medium" severity, they affect all three variants of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 includes the patches that were updated inside Node.js. 

Other problems 

The advisory also includes information about a DNS rebinding flaw in --inspect through improper IP addresses. Categorised as "high" severity, the bug (CVE-2022-32212) can permit arbitrary code execution, warns the advisory. 

“The IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not.When an invalid IPv4 address is provided browsers will make DNS requests to the DNS server, providing a vector for an attacker-controlled DNS server or a MitM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884,” says the advisory. 

The flaw affects all variants of the 18.x, 16.x, and 14.x releases lines.

Read more »
Vulnerabilities and Exploits
JavaScript Node.js NPM Package Vulnerabilities and Exploits

Critical Flaws in NPM Package Patched by Node.js Developers

 

Node.js maintainers have launched a major update to the npm package "tar" (aka node-tar) that resolves five critical safety flaws, including some that possess a remote code execution threat. 

The npm package was vulnerable to arbitrary File Creation/Overwrite vulnerability due to insufficient relative path sanitization. The npm package presents itself as a module that accepts JavaScript proxy configuration files and creates a function for the user’s app to locate certain domains. 

The first three flaws tracked as CVE-2021-37712, CVE-2021-37701, and CVE-2021-37701 fall into the high-risk category while the other two flaws were categorized as being of moderate risk. 

“Path integrity controls built into the technology came unstuck when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems”, as explained in a National Vulnerability Database (NVD).

“The cache checking logic used both `\` and `/` characters as path separators, however `\` is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite,” it added. 

These five security flaws seriously impact those who use npm package versions prior to 5.0.0, even transitively in their Node.js application, and: 

• Explicitly use PAC files for proxy configuration or 
• Read and use the operating system proxy configuration in Node.js on systems with WPAD enabled or • Use proxy configuration (env vars, config files, remote config endpoints, command-line arguments) from an untrusted source 

“If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the file system, but _not_ from the internal directory cache, as it would not be treated as a cache hit,” researchers explained. 

Node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. The CVE-2021-37712 vulnerability violates this control, thus creating a risk from malformed tar archives similar to the CVE-2021-37701 vulnerability.
Read more »
Vulnerabilities and Exploits
Domain Hijacking Assaults Node.js User Security Vulnerabilities and Exploits

Critical Flaws Allowing Domain Hijacking Assaults Patched By Node.js Developers

 

A vulnerability in Node.js that would permit a remote actor to carry out domain hijacking assaults has been patched. Last week, the developers of the Node.js, a JavaScript runtime environment published a security advisory to warn customers of a potential cyber-attack and to upgrade to the latest version to safeguard their devices against a series of flaws.

The first flaw tracked as CVE-2021-3672/CVE-2021-2293 was a result of improper handling of untypical characters in domain names, which created a doorway to remote code execution (RCE), or cross-site scripting (XSS) exploits. 

The flaw which has been classified in a high-risk category by security researchers also caused application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js which can lead to the output of wrong hostnames (leading to Domain hijacking) and injection vulnerabilities in applications using the library. 

A second vulnerability (CVE-2021-22939) is the incomplete validation of “rejectUnauthorized” parameter. However, it falls into a low-risk category. 

The third and final flaw (CVE-2021-22930) which could permit an attacker to abuse memory corruption to change process behavior was included as a follow-up fix after previous mitigations did not completely patch the issue.

Security researchers published the security advisory on the same day that a research paper (PDF) related to this topic was published. Researchers Philipp Jeitner and Haya Shulman demonstrated in the research, titled ‘Injection Attacks Reloaded: Tunnelling Malicious Payloads over DNS’ “a new method to launch string injection attacks by encoding malicious payloads into DNS records”. 

Earlier this year, the developers of systeminformation, a popular Node.js package, patched a critical flaw that left applications susceptible to command injection assaults. Systeminformation offers dozens of functions for retrieving detailed hardware, system, and operating system information from servers hosting Node.js applications. The library has more than 850,000 weekly downloads on NPM, the main online repository for the Node.js package 

The vulnerability was caused by a special case of improper parameter checking and array sanitation, Hildebrandt, the maintainer of the Systeminformation, stated. 

“If the input was not sanitized and users had the possibility to pass a JavaScript array as a parameter to the given functions, this could lead to executing malicious code like [a denial of service] DoS on the machine where systeminformation is running,” he further added.
Read more »
Vulnerabilities and Exploits
cybercriminals JavaScript Node.js RCE Vulnerabilities and Exploits

Node.js Pushes Out Immediate Fixes for the Severe HTTP Bug

 

Node.js has released patches for a high-severity vulnerability that could be used by attackers to corrupt the process and cause unexpected behaviour including application crashes and possibly remote code execution (RCE). The CVE-2021-22930 use-after-free vulnerability affects the way HTTP2 streams are handled in the language. 

Node.js is a back-end JavaScript runtime environment that runs on the V8 engine and executes JavaScript code outside of a browser. Node.js allows developers to utilise JavaScript to create command-line tools and server-side scripting, which involves running scripts on the server before sending the page to the user's browser. This week, Node.js released patches for CVE-2021-22930, a high-severity use-after-free vulnerability. 

When a programme tries to access a resource at a memory address that has already been freed and no longer holds the resource, it is called a use-after-free vulnerability. In some situations, this might result in data corruption, unexpected behaviours including programme crashes, or even remote code execution (RCE). The changes were included in the most recent Node.js release 16.6.0, as well as versions 12.22.4 (LTS) and 14.17.4. (LTS). This flaw was discovered by Eran Levin, who is credited with reporting it. 

"We normally like to give advance notice and provide releases in which the only changes are security fixes, but since this vulnerability was already public we felt it was more important to get this fix out fast in releases that were already planned," announced Red Hat principal software engineer and NodeJS Technical Steering Committee (TSC) member Daniel Bevenius. 

When Node.js read incoming RST_STREAM frames with no error code or cancel code, the vulnerability was exploited. In HTTP/2 applications, the RST_STREAM frame is issued by the host when it wants to close a connection. In a client-server architecture, for example, a client programme would send a RST_STREAM frame to the server to terminate the connection. When the server receives the frame, it will stop replying to the client and terminate the connection. The server might then discard any "DATA" frames it was about to send to the client.

When a RST_STREAM frame was received by the server with a "cancel" code (nghttp2_cancel) in vulnerable Node.js versions, the receiver would try to "force purge" any data received. After that, an automatic call-back would perform the "close" function a second time, aiming to free up the memory that had already been freed in the previous phase. 

And, as a result of the double-free error, the application might crash or behave erratically. On June 8th, 2021, Matthew Douglass posted a public thread about this issue, which was previously considered of as a "bug" rather than an exploitable vulnerability.
Read more »
Vulnerabilities and Exploits
Bug Captain Freak Node.js RCE Vulnerabilities and Exploits

Node.js Detected with Vulnerability encountered by Captain Freak

 

Node.js is a cross-platform, open-source, JavaScript back-end operating environment running on Chrome V8 and running JavaScript programming from outside a Web browser. Recently a vulnerability in Node.js could have been used to exploit the framework and achieve remote code execution (RCE). 

A report published on January 23, by Shoeb 'Captain Freak' Patel a self-described 'want to be' security researcher, says that the analysis indicates that Express.js might be prone to read local file errors. In conjunction with an old version of the Handlebars engine (Handlebars is a popular templating engine for web applications.), the malicious code may be run remotely. “If you are using Express.Js with Handlebars as templating engine invoked via hubs view engine, for Server Side Rendering, you are likely vulnerable to Local File Read (LFR) and potential Remote Code Execution (RCE),” stated Captain Freak. 

Further Captain Freak has claimed that because of his experience with the developer's code he wanted to search for flaws in Node.js, Express.js, and Handlebars. He said that he "stumbled" last week over a vital local security file that demanded a payload of fewer than 10 lines of code for the RCE exploit, and “To be honest, I should not have been that surprised.” 

“The betrayal by in-built modules, dependencies, and packages have been the reason to introduce numerous security bugs. This is a recurring theme in software security,” added Captain Freak. 

He elucidated that if the target user is responding with X-Powered-By: Express and there is HTML in responses, it’s highly likely that Node.js with server-side templating is being used. For which the user can attach a layout to the discovery for the GET or POST body parameter in their wordlist. If the arbitrary value of layout parameter added is resulting in 500 Internal Server Error with ENOENT: no such file or directory in body, then the user has hit the LFR. 

The treason of built-in modules, dependencies, and applications has contributed to various security vulnerabilities. In software safety, this is still a recurrent issue. Captain Freak created a CTF challenge to verify whether or not this was understood, and he shared it with several of his talented friends from different Network security, Node, Backend Tech, CTF, and Bug Bounty internet forums. 

Later this turned out to be a not known vulnerability, only 4 people (all CTFers) were able to solve this problem even after providing the whole source code. Captain Freak discovered, strange code at Node.js, that any file with an extension could be read from the root view directory, + layout and forwarded to handlebars; Compilation of which lets us use the HTML file that we fully monitor after compiling the file. RCE will then be triggered with particular specifications, requiring the use of versions 4.0.3 and below. This issue has been patched in Handlebars versions 4.1.2, 4.0.14, and later. 

“I wrote about it so that the whole Node.js and web development community [would] know about this quirky behavior in this stack,” stated Captain Freak.
Read more »
Subscribe to: Posts (Atom)