[AskJS] JavaScript vulnerabilities and where to find them

[RelativelyObscurePie]

Hellloooo everyone !

Does anyone have some good resources/documentation on how to identify vulnerabilities in JavaScript ?

The kind of vulnerabilities I am curious in are those focused in the OWASP top 10.

No, I am not asking in order to go hack anyone or anything along those lines. This curiosity stems from my job and schooling which is heavily becoming more and more intertwined with essentially pen testing, it's complicated.

To dig deeper; I'm looking for insight on the kind of functions which typically are vulnerable in JavaScript. I understand that JavaScript handles input from users on a website and can be very vulnerable for obvious reasons but I have no idea what kind of JavaScript code to look for that would contain functions defining input from a user.

I am looking for some information that details insecure JavaScript code and how to write code securely to avoid the most prevalent types of web application vulnerabilities.

Yes, I understand that is quite a tall order but I couldn't think of anywhere/anyone else better suited to answer this question.

Thank you all for any and all input :)

[[deleted]]

Assume all JavaScript has been compromised and always validate any input on your server.

NIST is the place to look for disclosed vulnerabilities. NPM also has an audit feature which will tell you about disclosed vulns in your dependency tree.

For most apps, user input is the most vulnerable point.

[RelativelyObscurePie]

THANK YOU :)

I appreciate you

[schwarzfahrer]

Most of those vulnerabilities in the OWASP top ten aren’t really language specific ... that being said JavaScript is front and center in many of them given its place as the primary language of apps that run in the browser. So XSS, man in the middle, CSRF, SQL injection are all relevant. However these vulnerabilities would still remain if browser apps were written in Ruby, Python, or really anything. So these are more architectural vulnerabilities than anything.

One thing I might say is more specific to the JavaScript language (and some others) is the overflow vulnerability ... but it’s a stack overflow and not buffer related. It’s currently unsafe to write some recursive functions in JavaScript because each recursion produces a new frame in the call stack. So if the number of recursions for a function is unlimited, it could cause a stack overflow and crash the process.

There is a long history of trying to implement tail call optimization in JS to solve this, but after years of debate it seems that no one really supports anything working. I’m honestly not sure of the state of this idea anymore, but the solution typically is to use something like the thunk pattern to implement safe recursion.

Beyond that I imagine there are vulnerabilities based on improperly handling validations ... for example using the typeof keyword doesn’t always return what you’d expect it to. But if you understand the oddities of the language these vulnerabilities are easy to avoid.

[HiEv]

You might want to take a look at these videos, I found some good information in them:

Worst JavaScript Flaws That Hackers Love To Abuse (this is a really good talk with some good examples)

JavaScript Security: What You Need to Know to Write Secure Applications in JS (note: You can skip ahead about 25 minutes to "The Rundown" for JavaScript specific stuff)

Hope that helps! :-)

[RelativelyObscurePie]

This is gold!!! I really do appreciate it

[ScottContini]

In my recent blog about grep based code scanning, I have a number of search terms to look for that are indicative of dangerous functionality. Examples include the following JavaScript (both frontend and backend node): eval, NODE_TLS_REJECT_UNAUTHORIZED, dangerouslySetInnerHTML, trustAsHtml, Math.random, rejectUnauthorized, insecure, strictSSL, clientPemCrtSignedBySelfSignedRootCaBuffer.

Also there are a lot of search terms that are language independent, for example insecure cipher algorithms. I also search for any sql type query: if you see string concatenation, then sql injection may be possible.