nodejs-cmd-injection/index.ejs at main · ekiscyber/nodejs-cmd-injection · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
<!DOCTYPE html>
<html>
  <!doctype html>
  <html lang="en">

  <head>
    <title>NodeJS Application</title>
    <!-- Required meta tags -->
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/styles/default.min.css">
    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/highlight.min.js"></script>
    <script>hljs.highlightAll();</script>

     <style>
        body {
          position: relative; /* For scrollyspy */
          padding-top: 40px; /* Account for fixed navbar */
          font-size: 15px;
        }


    </style>
  </head>

  <body>
      <div class='container' style='min-height: 450px'>
<h2> Command Injection:</h2> <p> User supplied input directly passed to exec function without santization.</p>
<h3> Vulnerable Code:</h3>
<pre>
    <code class="language-javascript">
        const exec = require('child_process').exec
        ....
        const ping = req.body.ping;
        exec('ping -c 3 ' + req.body.ping, function (err, stdout, stderr){
            output = stdout + stderr;
            console.log(output)
            res.render('ping', {
            output: output
            });
        })
    </code>
</pre>

<form action="/" method="POST">
  <input type="text" name="ping" placeholder="8.8.8.8">
  <input type="submit" value="ping">
</form>
<% if (output) { %>
  <br>
<p> Command Output </p>
<pre>
<%= output %>
</pre>
<% } %>
</h3>
<br>

<h2>Fixed version</h2>
<p> In this version application uses `execFile` function from the `child_process` module that starts a specific program
and takes an array of arguments.
<h3> Fixed Code</h3>
<pre>
    <code class="language-javascript">
  const execFile = require('child_process').execFile;
  ...
  execFile('/usr/bin/ping', ['-c', '3', ping1], function (err, stdout, stderr){
    pingoutput = stdout + stderr;
    res.render('ping', {
      pingoutput: pingoutput,
      output: null
    });
  });
    </code>
</pre>
<form action="/" method="POST">
  <input type="text" name="ping1">
  <input type="submit" value="ping1">
</form>
<br>
<% if (pingoutput) { %>
<p> Command Output </p>
<pre>
<%= pingoutput %>
</pre>
<% } %>

</body>
</html>