Node.js is a cross-platform, open-source, JavaScript back-end operating environment running on Chrome V8 and running JavaScript programming from outside a Web browser. Recently a vulnerability in Node.js could have been used to exploit the framework and achieve remote code execution (RCE).
A report published on January 23, by Shoeb 'Captain Freak' Patel a self-described 'want to be' security researcher, says that the analysis indicates that Express.js might be prone to read local file errors. In conjunction with an old version of the Handlebars engine (Handlebars is a popular templating engine for web applications.), the malicious code may be run remotely. “If you are using Express.Js with Handlebars as templating engine invoked via hubs view engine, for Server Side Rendering, you are likely vulnerable to Local File Read (LFR) and potential Remote Code Execution (RCE),” stated Captain Freak.
Further Captain Freak has claimed that because of his experience with the developer's code he wanted to search for flaws in Node.js, Express.js, and Handlebars. He said that he "stumbled" last week over a vital local security file that demanded a payload of fewer than 10 lines of code for the RCE exploit, and “To be honest, I should not have been that surprised.”
“The betrayal by in-built modules, dependencies, and packages have been the reason to introduce numerous security bugs. This is a recurring theme in software security,” added Captain Freak.
He elucidated that if the target user is responding with X-Powered-By: Express and there is HTML in responses, it’s highly likely that Node.js with server-side templating is being used. For which the user can attach a layout to the discovery for ..
Support the originator by clicking the read the rest link below.
