[Nodejs] Security: Command Injectionโ€‚by@peterchang_82818

[Nodejs] Security: Command Injection

June 23rd 2022 20,534 reads
Read on Terminal Reader
react to story with heart
react to story with light
react to story with boat
react to story with money
image
image
This is a note about Node.js security, by reading the amazing book Securing Node Applications by @ChetanKarade, which explains couple of common vulnerabilities in very simple way, and provides relevant npm modules as solutions to protect Node.js Web Apps.

Command Injection

An injection vulnerability manifests when application code sends untrusted user input to an interpreter as part of a command or query.









...app.get('/', function (req, res) {child_process.exec('gzip ' + req.query.file_path, function (err, data) {console.log('err: ', err)console.log('data: ', data);});res.send('Hello World!')})...

Execute a malicious

Open the page on browser, with file_path as parameter
http://localhost:3000/?file_path=app.js
image

Injection vulnerability

To exploit the injection vulnerability in the preceding code, an attacker can append rm -rf /, for instance, to the file_path input.
This allows an attacker to break out of the gzip command context and execute a malicious command that deletes all files on the server.
image

Preventing Command Injection


  • Use EXECFILE or SPAWN instead of **_EXEC_**spawn and execFile method signatures force developers to separate the command and its arguments
  • Input validation
  • Limit user privileges

You may alsoย like

Like this story? It is helpful to others? It helps me know if youโ€™d like to see write more about his topic and helps people see the story, when tap the heart below.

Reference:

react to story with heart
react to story with light
react to story with boat
react to story with money
L O A D I N G
. . . comments & more!