Introduction
Node.JS is a Cross Platform and
Runtime Environment Where one can execute javascript code, outside the Web
Browser. Node.JS is Very helpful but it has a couple of Killing features which
make it very dangerous and hazardous for a web application. In this tutorial we
are going to discuss one of them, Command Execution in Node.JS, You Folks must
know what is Command Execution but just to be sure I’d like to tell you,
Command Execution Vulnerabilities Allow an Attacker to run arbitrary Commands
on a System through the Vulnerable Environment. I guess its enough for
introcution.
Vulnerable
Code
Here is vulnerable code which demonstrates
the vulnerability in node js.
I’ll simply give the overview
about where exactly its getting hectic. We are using exec function from child_process
library, and executing parsedUrl.query.command,
that is not getting filtered. Hence an attacker can execute any arbitrary
commdn in order to hack into system. Let’s Save it and run it. Here is my
script running.
Code is working without any
error, let’s try to visit the url 127.0.0.1:8888
in browser as it is listening on port 8888.
Whoa, we got it working. Now its
time to do some evil stuff. Let’s try to execute systeminfo, PING & Some other commands , that displays
information about a computer.
#fig1
#fig2
#fig3
Okay fine, as it is clear from
the above POC that its working
exactly fine. In this context a developer must be careful while working with
Node.JS files as its kinda more hectic and Evil than other languages.
About the
Author
Muhammad
Adeel is a Security researcher & Founder at Whitehat Conference
Pakistan, he Blogs at http://urdusecurity.blogspot.com
