Server Side JS Injection

[codelion]

A server side JS injection is possible in wepl.

The problem is with the following code in wepl.js file

 with(global) {result = util.inspect(eval(req.query.methodBody), true, 3)};

In above code eval() is called on untrusted user input from request query. Just passing the following to the application will lead to shutting it down.

?methodBody=process.exit()

In addition you can access the file system and delete any file on the server using

res.end(require('fs').readFileSync(filename))