Running static file server anywhere.
To embed malicious
/ character is necessary.
In all operating systems,
/ is not allowed as a character used in file name. This means there is very few option to craft an attack using file name as injection point.
However, if attacker wants to, one can still use some tricks and change one of the filenames into something like following example:
Then, HTML file with following content have to be saved in the same directory as file with the name changed:
<head> <meta charset="utf8" /> <title>Frame embeded with malware :P</title> </head>
src attribute value I've used here is just for PoC purpose, this can be any external url.
On my local machine,
malware.js has following content:
alert('Uh oh, I am very bad malware!')
Now, if you run
anywhere in directory where both file with filename changed and
malware_frame.html are saved:
$ ./node_modules/anywhere/bin/anywhere -p 8080
Running at http://192.168.1.1:8080/
Also running at https://192.168.1.1:8081/
malware.js is executed:
Configuration I've used to find this vulnerability:
I hope this report will help to keep Node ecosystem more safe. If you have any questions about any details of this finding, please let me know in comment.
Rafal 'bl4de' Janicki
Exploitation of this vulnerability in the wild might be hard, however it's not impossible and it depends only on attacker's skills to get into directory on the server, where
anywhere is used to serve static content.