add jsonpath plus lib #25
Conversation
|
📦 Vulnerable Dependencies✍️ Summary
🔬 Research Details[ CVE-2019-10744 ] lodash 4.17.1Description: The function Example of code vulnerable to this issue - const lodash = require('lodash');
const evilsrc = {constructor: {prototype: {evilkey: "evilvalue"}}};
lodash.defaultsDeep({}, evilsrc)Remediation: Development mitigationsAdd the [ CVE-2023-29827 ] ejs 3.1.6Description: When rendering views using EJS, it is possible to bypass ejs' template injection restrictions, by abusing the
The vulnerability was rightfully disputed due to the fact that a vulnerable configuration is extremely unlikely to exist in any real-world setup. As such, the maintainers will not provide a fix for this (non-)issue. Example of a vulnerable application - const express = require('express')
const app = express()
const port = 3000
app.set('view engine', 'ejs');
app.get('/page', (req,res) => {
res.render('page', req.query); // OPTS (2nd parameter) IS ATTACKER-CONTROLLED
})
app.listen(port, () => {
console.log("Example app listening on port ${port}")
})Contents of %%1");process.mainModule.require('child_process').execSync('calc');//In this case, sending [ CVE-2022-29078 ] ejs 3.1.6Description: When rendering views using EJS, it is possible to perform template injection on the Once template injection is achieved, the attacker can immediately perform remote code execution since the template engine (EJS) allows executing arbitrary JavaScript code. Example of a vulnerable Node.js application - const express = require('express');
const bodyParser = require('body-parser');
const lodash = require('lodash');
const ejs = require('ejs');
const app = express();
app
.use(bodyParser.urlencoded({extended: true}))
.use(bodyParser.json());
app.set('views', './');
app.set('view engine', 'ejs');
app.get("/", (req, res) => {
res.render('index');
});
app.post("/", (req, res) => {
let data = {};
let input = JSON.parse(req.body.content);
lodash.defaultsDeep(data, input);
res.json({message: "OK"});
});
let server = app.listen(8086, '0.0.0.0', function() {
console.log('Listening on port %d', server.address().port);
});Exploiting the above example for RCE - Due to the prototype pollution in the Remediation: Development mitigationsAdd the Note that this mitigation is supposed to stop any prototype pollution attacks which can allow an attacker to control the The mitigation will not stop any (extremely unlikely) scenarios where the JavaScript code allows external input to directly affect [ CVE-2024-21534 ] jsonpath-plus 10.0.0Description: Note: There was an attempt to fix it in version 10.0.0 but it could still be exploited using different payloads. [ CVE-2024-45296 ] path-to-regexp 0.1.7Description: Remediation: Development mitigationsThis vulnerability can be mitigated by manually defining the parameter's regular expression when two or more parameters exist in a single segment. For example, [ CVE-2018-16487 ] lodash 4.17.1Description: The The library implementation has a bug in the A related CVE (CVE-2018-3721) covers the same issue prior to Lodash version 4.17.5, but the fix for that was incomplete. Remediation: Development mitigationsAdd the [ CVE-2019-1010266 ] lodash 4.17.1Description: [ CVE-2018-3721 ] lodash 4.17.1Description: [ CVE-2024-43800 ] serve-static 1.15.0Description: [ CVE-2024-43799 ] send 0.18.0Description: [ CVE-2024-43796 ] express 4.18.2Description: [ CVE-2024-29041 ] express 4.18.2Description: [ CVE-2024-47764 ] cookie 0.5.0Description: [ CVE-2024-39249 ] async 3.2.5Description: [ CVE-2024-45590 ] body-parser 1.20.1Description: Remediation: Development mitigationsThe vulnerability can be mitigated by specifying [ CVE-2021-23337 ] lodash 4.17.1Description: lodash.template('', { variable: '){console.log(process.env)}; with(obj' })()[ CVE-2020-8203 ] lodash 4.17.1Description: JavaScript frontend and Node.js-based backend applications that merge or zip objects using the lodash functions Remediation: Deployment mitigationsAs general guidelines against prototype pollution, first consider not merging objects originating from user input or using a Map structure instead of an object. If merging objects is needed, look into creating objects without a prototype with [ CVE-2024-33883 ] ejs 3.1.6Description: A prototype pollution gadget within the EJS template engine could potentially be leveraged by attackers to achieve remote code execution or DoS via prototype pollution. When checking for the presence of a property within an object variable, the lookup scope isn't explicitly defined. In JavaScript, the absence of a defined lookup scope prompts a search up to the root prototype ( If the application server is using the EJS as the backend template engine, and there is another prototype pollution vulnerability in the application, then the attacker could leverage the found gadgets in the EJS template engine to escalate the prototype pollution to remote code execution or DoS. The following code will execute a command on the server by polluting [ CVE-2020-28500 ] lodash 4.17.1Description: On a modern Core i7-based system, calling the vulnerable functions with a 50kB string could take between 2 to 3 seconds to execute and 4.5 minutes for a longer 500kB string. The fix improved the regular expression performance so it took only a few milliseconds on the same Core i7-based system. This vulnerability is easily exploitable as all is required is to build a string that triggers it as can be seen in this PoC reproducing code - var untrusted_user_input_50k = "a" + ' '.repeat(50000) + "z"; // assume this is provided over the network
lo.trimEnd(untrusted_user_input_50k); // should take a few seconds to run
var untrusted_user_input_500k = "a" + ' '.repeat(500000) + "z"; // assume this is provided over the network
lo.trimEnd(untrusted_user_input_500k); // should take a few minutes to runRemediation: Deployment mitigationsTrim untrusted strings based on size before providing it to the vulnerable functions by using the |
at 📦🔍 Contextual Analysis CVE Vulnerability
DescriptionThe scanner checks whether the vulnerable function CVE detailsVersions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. RemediationDevelopment mitigationsAdd the |
at 📦🔍 Contextual Analysis CVE Vulnerability
DescriptionThe scanner checks whether any of the following conditions are met:
CVE detailsejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input. |
at 📦🔍 Contextual Analysis CVE Vulnerability
DescriptionThe scanner checks for two vulnerable flows:
The scanner also checks whether the CVE detailsThe ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation). RemediationDevelopment mitigationsAdd the Note that this mitigation is supposed to stop any prototype pollution attacks which can allow an attacker to control the The mitigation will not stop any (extremely unlikely) scenarios where the JavaScript code allows external input to directly affect |
at 📦🔍 Contextual Analysis CVE Vulnerability
DescriptionThe scanner checks whether any of the following vulnerable functions are called:
The scanner also checks whether the CVE detailsA prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype. RemediationDevelopment mitigationsAdd the |
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewTemplate Object Injection (TOI) is a vulnerability that can occur in Query operationIn this query we look for user inputs that flow directly to a Vulnerable examplevar app = require('express')();
app.set('view engine', 'hbs');
app.use(require('body-parser').json());
app.use(require('body-parser').urlencoded({ extended: false }));
app.post('/path', function(req, res) {
var bodyParameter = req.body.bodyParameter;
var queryParameter = req.query.queryParameter;
res.render('template', bodyParameter);
});In this example, a user-provided data is injected directly into the Remediation+ const sanitizeHtml = require('sanitize-html');
var app = require('express')();
app.set('view engine', 'hbs');
app.use(require('body-parser').json());
app.use(require('body-parser').urlencoded({ extended: false }));
app.post('/path', function(req, res) {
var bodyParameter = req.body.bodyParameter;
var queryParameter = req.query.queryParameter;
- res.render('template', bodyParameter);
+ res.render('template', sanitizeHtml(bodyParameter));
});
Using `sanitize-html`, the user-provided data is sanitized, before
rendering to the response.Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewHelmet library should be used when using Express in order to properly configure Remediationconst helmet = require("helmet");
const app = express()
app.use(helmet())References |
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewA use of insecure random vulnerability is a type of security flaw that is Vulnerable examplevar randomNum = Math.random();
Remediationvar randomNum = crypto.randomInt(0, 100)
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewA use of insecure random vulnerability is a type of security flaw that is Vulnerable examplevar randomNum = Math.random();
Remediationvar randomNum = crypto.randomInt(0, 100)
|
No description provided.