Conversation
|
📦 Vulnerable Dependencies✍️ Summary
🔬 Research Details[ CVE-2019-10744 ] lodash 4.17.0Description: The function Example of code vulnerable to this issue - const lodash = require('lodash');
const evilsrc = {constructor: {prototype: {evilkey: "evilvalue"}}};
lodash.defaultsDeep({}, evilsrc)Remediation: Development mitigationsAdd the [ CVE-2023-29827 ] ejs 3.1.6Description: When rendering views using EJS, it is possible to bypass ejs' template injection restrictions, by abusing the
The vulnerability was rightfully disputed due to the fact that a vulnerable configuration is extremely unlikely to exist in any real-world setup. As such, the maintainers will not provide a fix for this (non-)issue. Example of a vulnerable application - const express = require('express')
const app = express()
const port = 3000
app.set('view engine', 'ejs');
app.get('/page', (req,res) => {
res.render('page', req.query); // OPTS (2nd parameter) IS ATTACKER-CONTROLLED
})
app.listen(port, () => {
console.log("Example app listening on port ${port}")
})Contents of %%1");process.mainModule.require('child_process').execSync('calc');//In this case, sending [ CVE-2022-29078 ] ejs 3.1.6Description: When rendering views using EJS, it is possible to perform template injection on the Once template injection is achieved, the attacker can immediately perform remote code execution since the template engine (EJS) allows executing arbitrary JavaScript code. Example of a vulnerable Node.js application - const express = require('express');
const bodyParser = require('body-parser');
const lodash = require('lodash');
const ejs = require('ejs');
const app = express();
app
.use(bodyParser.urlencoded({extended: true}))
.use(bodyParser.json());
app.set('views', './');
app.set('view engine', 'ejs');
app.get("/", (req, res) => {
res.render('index');
});
app.post("/", (req, res) => {
let data = {};
let input = JSON.parse(req.body.content);
lodash.defaultsDeep(data, input);
res.json({message: "OK"});
});
let server = app.listen(8086, '0.0.0.0', function() {
console.log('Listening on port %d', server.address().port);
});Exploiting the above example for RCE - Due to the prototype pollution in the Remediation: Development mitigationsAdd the Note that this mitigation is supposed to stop any prototype pollution attacks which can allow an attacker to control the The mitigation will not stop any (extremely unlikely) scenarios where the JavaScript code allows external input to directly affect [ CVE-2021-23555 ] vm2 3.9.4Description: [ XRAY-264729 ] cors.js 0.0.1-securityDescription: Remediation: Removing the malicious packageRun Refreshing stolen credentialsMany malicious packages steal stored user credentials, focusing on the following -
It is highly recommended to change or revoke data that is stored in the infected machine at those locations Stopping malicious processesMany malicious packages start malicious processes such as connectback shells or crypto-miners. Search for any unfamiliar processes that consume a large amount of CPU or a large amount of network traffic, and stop them. On Windows, this can be facilitated with Sysinternals Process Explorer. Removing installed backdoorsMany malicious packages install themselves as a persistent backdoor, in order to guarantee the malicious code survives a reboot. Search for any unfamiliar binaries set to be run on startup, and remove them. On Windows, this can be facilitated with Sysinternals Autoruns. Defining an Xray policy that blocks downloads of Artifacts with malicious packagesIt is possible to create an Xray policy that will not allow artifacts with identified malicious packages to be downloaded from Artifactory. To create such a policy, add a new Contacting the JFrog Security Research team for additional informationOptionally, if you are unsure of the full impact of the malicious package and wish to get more details, the JFrog Security Research team can help you assess the potential damage from the installed malicious package. Please contact us at research@jfrog.com with details of the affected artifact and the name of the identified malicious package. [ CVE-2024-45296 ] path-to-regexp 0.1.7Description: Remediation: Development mitigationsThis vulnerability can be mitigated by manually defining the parameter's regular expression when two or more parameters exist in a single segment. For example, [ CVE-2023-37903 ] vm2 3.9.4Description: [ CVE-2023-37466 ] vm2 3.9.4Description: [ CVE-2023-36665 ] protobufjs 6.11.2Description: Multiple prototype pollution vulnerabilities were detected in the
protobuf.util.setProperty({}, "constructor.prototype.verified", true);
let obj = new protobuf.ReflectionObject("Test");
obj.setParsedOption("unimportant!", attackerFunc, "constructor.prototype.testFn");
protobuf.parse('option(a).constructor.prototype.verified = true;');
protobuf.loadSync("poc.proto");an example malicious While most prototype pollution attacks lead to denial of service, it has been reported that code execution is possible when unsanitized user input is provided to the functions Remediation: Development mitigationsAdd the [ CVE-2023-32314 ] vm2 3.9.4Description: [ CVE-2023-30547 ] vm2 3.9.4Description: To prevent the leaking of host context information into the virtual machine, the code given to the However, this may be proxied through a Example of running untrusted code in the sandbox - [ CVE-2023-29199 ] vm2 3.9.4Description: To prevent the leaking of host context information into the virtual machine, the code given to the Example of running untrusted code in the sandbox - Example of malicious code that triggers the issue when processed by the Remediation: Development mitigationsPrevent user code to contain const { VM } = require('vm2');
const vm = new VM();
const code = userInputCode();
...
const modifiedCode = code.replace(/$tmpname/g, 'myCustomName');
vm.run(modifiedCode);[ CVE-2023-29017 ] vm2 3.9.4Description: Specifically, the Example of running untrusted code in the sandbox - [ CVE-2022-25893 ] vm2 3.9.4Description: The vm2 package provides a secure virtual environment for running untrusted code, which cannot be escaped to the host machine. Specifically, the Vulnerable code snippet - Remediation: Development mitigationsPrefix the untrusted code with new VM().run( // Untrusted code here... [ CVE-2022-36067 ] vm2 3.9.4Description: It was discovered that due to insecure error handling, an attacker could create code that runs inside the sandbox but eventually creates an object outside of the sandbox that would be subsequently executed. This allows the attacker to perform malicious operations such as execution arbitrary shell commands using the The vulnerability has an extensive technical writeup, making the creation of a PoC trivial. Example of running untrusted code in the sandbox - const {VM} = require('vm2');
new VM().run(attacker_javascript_code_as_string);Remediation: Development mitigationsDefine the global const {VM} = require('vm2');
const vm2 = new VM();
// Define the Error object
vm2.sandbox.Error = Error;
// Now we can execute untrusted code
new VM().run(attacker_javascript_code_as_string);[ CVE-2024-45590 ] body-parser 1.20.1Description: Remediation: Development mitigationsThe vulnerability can be mitigated by specifying [ CVE-2022-25878 ] protobufjs 6.11.2Description:
protobuf.util.setProperty({}, "__proto__.someprop", "somevalue");
let obj = new protobuf.ReflectionObject("Test")
obj.setParsedOption({}, "somevalue", "__proto__.someprop");
let p = `option (foo).__proto__.someprop= "somevalue";`
protobuf.parse(p)
protobuf.load("/path/to/untrusted.proto", function(err, root) { ... });Remediation: Development mitigationsAdd the [ CVE-2021-23337 ] lodash 4.17.0Description: lodash.template('', { variable: '){console.log(process.env)}; with(obj' })()[ CVE-2020-8203 ] lodash 4.17.0Description: JavaScript frontend and Node.js-based backend applications that merge or zip objects using the lodash functions Remediation: Deployment mitigationsAs general guidelines against prototype pollution, first consider not merging objects originating from user input or using a Map structure instead of an object. If merging objects is needed, look into creating objects without a prototype with |
at 🛠️ Infrastructure as Code Vulnerability
Full descriptionProvider
See Terraform's Authentication and Configuration for more details Vulnerable example - Secure example #1 - (using configuration files) Secure example #2 - (using environment variables) |
at 🛠️ Infrastructure as Code Vulnerability
Full descriptionProvider
See Terraform's Authentication and Configuration for more details Vulnerable example - Secure example #1 - (using configuration files) Secure example #2 - (using environment variables) |
at 🛠️ Infrastructure as Code Vulnerability
Full descriptionResource Vulnerable example - Secure example - |
at 🛠️ Infrastructure as Code Vulnerability
Full descriptionIf resource Vulnerable example - Secure example - |
1 similar comment
at 🛠️ Infrastructure as Code Vulnerability
Full descriptionIf resource Vulnerable example - Secure example - |
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewTemplate Object Injection (TOI) is a vulnerability that can occur in Query operationIn this query we look for user inputs that flow directly to a Vulnerable examplevar app = require('express')();
app.set('view engine', 'hbs');
app.use(require('body-parser').json());
app.use(require('body-parser').urlencoded({ extended: false }));
app.post('/path', function(req, res) {
var bodyParameter = req.body.bodyParameter;
var queryParameter = req.query.queryParameter;
res.render('template', bodyParameter);
});In this example, a user-provided data is injected directly into the Remediation+ const sanitizeHtml = require('sanitize-html');
var app = require('express')();
app.set('view engine', 'hbs');
app.use(require('body-parser').json());
app.use(require('body-parser').urlencoded({ extended: false }));
app.post('/path', function(req, res) {
var bodyParameter = req.body.bodyParameter;
var queryParameter = req.query.queryParameter;
- res.render('template', bodyParameter);
+ res.render('template', sanitizeHtml(bodyParameter));
});
Using `sanitize-html`, the user-provided data is sanitized, before
rendering to the response.Code FlowsVulnerable data flow analysis result
|
1 participant
No description provided.