NodeJS - Race Condition
Running the app on Docker
Now that the app is running let's go hacking!
Reconnaissance
Step1
Congratulations, you won the race
All you need to do now is to add your name to the board and get your price.
The application shows an input box, where you can insert your username and go to the next screen, clicking "Make it mine".
The application verifies whether the username contains special characaters such as "
and \
and erases them. It also applies strict filtering on the text using the following regex:
[A-Za-z0-9 ]*
If the username is correct, clicking Boot
will put us on the score board. Yeah!!
Step 2
This application suffers from a race condition vulnerability, but how can we identify it?
If we look at the code we see that there are 4 functions being used:
boot_validate(person)
the function receives the username in input and executes the following:
deletes
"
and\
from the usernameopens
hello.sh
filewrites a command in it
closes the file
logs some useful info
checks if the username is in the format
[A-Za-z0-9 ]*
returns the username if the regex succedes
boot_clean()
that removes all the hello files (hello.sh
andhello.txt
)boot_run()
executes thehello.sh
fileboot_reset()
resets the system to the default settings
Step 3
If we intercept the traffic generate by the app we see that:
a GET request is issued to validate the username and call
boot_validate(person)
clicking boot, will generate the request to execute the
boot_run()
function
The logic behind the application is in the function start()
. If the action is not validate
or reset
, the application runs boot_run()
executing the hello.sh
file.
We also notice that the function boot_validate(person)
first inserts the command in the hello.sh
and then validates the input, returning if it is valid or not.
Everything works fine, so where is the problem?
The problem is that in this case, we have a very small window to execute the boot_run()
function after the input is written in hello.sh
and just before return valid
is called. Again, there is a possibility to have a race condition only if the following steps are executed in this order:
pass our malicious payload to
boot_validate
write the malicious payload in
hello.sh
call
boot_run()
return valid
is called
Exploitation
Before we can exploit the race condition, we need a good payload that will execute the command for us. We know that the double quotes and the backslash cannot be used to break the command, but we also know that using '`' backtick.
So our payload will be:
in order to execute the command id
on the target system.
Now we can exploit this sequence to achieve a command injection. In order to do that we must send requests with high frequency.
Doing it manually is practically impossible, so we create a script that does that for us:
and in the meantime we send the other request from the browser like
If we look in the logs we will see:
Congratulations, you won the race for real now!!!!!!!!
Additional sources
Last updated