NodeJS vulnerability mining, attack and defense
10195101488
Cui Chenyang
2021/7/7
NodeJS
Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine.
As an asynchronous event-driven JavaScript runtime, Node.js is designed to build scalable network applications.
And a live example
CVE-2021-32736 (Published
What happened
- send request
- process request <====
- bomb!
Vuln Types
- Arbitrary Code Execution
- Command Injection
- Prototype Pollution
- Deny Of Service
- Resource Exhaustion
- SQL Injection
- Buffer Overflow
- Authorization Bypass
- Information Leak
- Path Traversal
- Weak Crypto/Random
Vuln Mining
- Manual Audit
- Choose a package
- Read all code
- Find bug
- Dig exploit chain
- Or
- Choose a package
- Reading...
- Fail
Or......
- Crawling packages
- Define Target
- Run automation tools
- Get CVEs
Related Research
- NOJITSU: Locking Down JavaScript Engines NDSS-2020
- Everything Old is New Again: Binary Security of WebAssembly USENIX-2020
- Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer USENIX-2020
- CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines NDSS-2019
- Fuzzing the Binding Code of JavaScript Engines Using Semantically Correct Tests NDSS-2020
Thanks
CTF
ID：Yoshino-s
方向：Misc & Web, NodeJS/Python
ECNU Metasequoia Leader
Union Team W&M Leader
Waiting For you
NodeJS vulnerability mining, attack and defense
By yoshino-s
