This is a note about Node.js security, by reading the amazing book Securing Node Applications by @ChetanKarade, which explains couple of common vulnerabilities in very simple way, and provides relevant npm modules as solutions to protect Node.js Web Apps.
Command Injection
An injection vulnerability manifests when application code sends untrusted user input to an interpreter as part of a command or query.
...app.get('/', function (req, res) {child_process.exec('gzip ' + req.query.file_path, function (err, data) {console.log('err: ', err)console.log('data: ', data);});res.send('Hello World!')})...
Execute a malicious
Open the page on browser, with file_path as parameter
http://localhost:3000/?file_path=app.js
Injection vulnerability
To exploit the injection vulnerability in the preceding code, an attacker can append rm -rf /, for instance, to the file_path input.
This allows an attacker to break out of the gzip command context and execute a malicious command that deletes all files on the server.
Preventing Command Injection
-
Use EXECFILE or SPAWN instead of **_EXEC_**spawn and execFile method signatures force developers to separate the command and its arguments
- Input validation
- Limit user privileges
You may also like
[Nodejs] Security: Broken Authentication
Like this story? It is helpful to others? It helps me know if you’d like to see write more about his topic and helps people see the story, when tap the heart below.
Reference:
https://github.com/wahengchang/nodejs-security-must-know
https://nodejs.org/api/child_process.html
https://www.techworm.net/2016/09/9-dangerous-linux-commands-never-execute-computer.html