Prototype pollution bug in popular Node.js library leaves web apps open to abuse

guest · Aug 3, 2020

Prototype pollution bug in popular Node.js library leaves web apps open to DoS, remote shell attacks
Package has been downloaded seven million times, but project maintainer believes most users are unaffected
August 3, 2020
https://portswigger.net/daily-swig/...ves-web-apps-open-to-dos-remote-shell-attacks

A flaw in the express-fileupload library allows hackers to stage prototype pollution attacks on Node.js servers, a security researcher has discovered.

express-fileupload, a Node.js package with more than seven million downloads, enables applications to process files uploaded in web applications.
The vulnerability, which was patched in the latest release of the library, opened the door to denial-of-service (DoS) attacks and, in some cases, remote shell access.

In his blog post, the security researcher known as ‘Posix’ shows how the vulnerability can be exploited to cause the Node.js server to crash and return internal server errors on every request, leading to denial of service.
Click to expand...

Shell access
According to Posix, the bug can also be used to attack other libraries, such as the popular EJS template engine, which is often used in combination with express-fileupload.
An attacker can use the express-fileupload to pollute EJS’s outputFunctionName parameter and gain shell access to the Node.js server.
Click to expand...

Inspired by similar work done by security researcher Michał Bentkowski, Posix was using NPM module analysis to find real-world prototype pollution bugs in Node.js applications when he found the express-fileupload bug.

“Vulnerabilities from JavaScript prototype or characteristics are often addressed in CTFs and other security competitions. But in the real world, very little research has been done,” Posix said.
Click to expand...

guest · Aug 4, 2020

NodeJS module downloaded 7M times lets hackers inject code
August 4, 2020
https://www.bleepingcomputer.com/ne...downloaded-7m-times-lets-hackers-inject-code/

A Node.js module downloaded millions of times has a security flaw that can enable attackers to perform a denial-of-service (DoS) attack on a server or get full-fledged remote shell access.

Assigned CVE-2020-7699, the vulnerability lies in the "express-fileupload" npm component, which has been downloaded at least 7.3 million times from npm.
The estimate is conservative as it does not take into account downloads from GitHub, mirror websites, and other cloned repositories.
Exploiting the Prototype
The actual attack is made possible because of the "parseNested" feature provided by express-fileupload. When enabled, the "parseNested" option is responsible for "flattening" the uploaded JSON data into nested objects.
Remote code execution via reverse shell
A more sophisticated variation of this exploit described by the researcher enables an attacker to get a shell on the vulnerable system. This exploit, however, largely depends on if the application using a vulnerable "express-fileupload" version, was also using the templating engine EJS (Embedded JavaScript templates).
Click to expand...

Within a few hours of receiving the researcher's report, the "express-fileupload" fixed the vulnerability, and users should consider getting the latest, patched version 1.1.9 from npm.
Click to expand...

guest · Sep 21, 2020

Node.js applications open to prototype pollution attacks via legacy function in popular encryption library
Dangerous bug could allow attackers to manipulate the behavior of an application by modifying its runtime
Septembre 21, 2020
https://portswigger.net/daily-swig/...legacy-function-in-popular-encryption-library

A carryover function in the popular node-forge JavaScript library contains a vulnerability that could allow attackers to carry out prototype pollution attacks against applications, according to an advisory on GitHub.

Node-forge, used by more than 3.5 million repositories, implements various cryptography utilities, the TLS protocol, and tools for developing web applications.
Prototype pollution is a dangerous bug that allows attackers to manipulate the behavior of an application by modifying its code at runtime.
Click to expand...

The vulnerability has been given a high-severity 9.8 score on Snyk and 7.3 by the National Vulnerability Database.
The maintainers of node-forge suggest using other libraries that have similar property-setting functionalities, such as lodash, but also warn about possible prototype pollution vulnerabilities in those libraries.
Click to expand...

guest · Jul 25, 2022

Node.js prototype pollution is bad for your app environment
Boffins find common code constructs that may be exploitable to achieve remote code execution
July 25, 2022

Back in March, security researchers reported a critical command injection vulnerability in Parse Server, an open-source backend for Node.js environments.

Rated 10 out of 10 on the CVSS scale of severity, the remote code execution hole was the result of prototype pollution, a security oversight that can be abused to hijack JavaScript code and the JavaScript-based Node.js runtime.
Click to expand...

They describe their work in a paper titled, "Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js," which was distributed this month and apparently has been submitted to next year's USENIX '23. Using their framework, which is built atop GitHub's static analysis framework CodeQL, they said they were able to find 11 universal gadgets – existing code structures – in the code Node.js API that can potentially enable remote code execution.

They then applied their approach of 15 popular Node.js applications and identified three instances vulnerable to remote code execution via prototype pollution. One was Parse Server, two others were in the NPM CLI.

"Prototype pollution is one of the most common security vulnerabilities found in JavaScript code," said Feross Aboukhadijeh, an open-source developer and founder of security scanning service Socket, in an email to The Register. "The issue is so common in JavaScript, in particular, because of the language’s design which heavily uses 'prototypal inheritance.'"
Click to expand...

"I was impressed that the authors were able to find three confirmed exploitable cases of prototype pollution, which is a nice change from the usual noise we get from CVE reports about prototype pollution, most of which are not actually exploitable. This research shows that prototype pollution is not just a theoretical risk."
Click to expand...

Log in or Sign up

Prototype pollution bug in popular Node.js library leaves web apps open to abuse

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Prototype pollution bug in popular Node.js library leaves web apps open to abuse

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches