Security in NodeJS applications

SECURE CODING WITH NODE.JS
OBJECTIVE
▸The purpose of the following micro-course is learning
by examples the major security flaws in code in
NodeJS, possible solutions and good security practices.

INDEX

OWASP TOP 10 WITH 1 PICTURE

CORRESPONDENCIA CON OWASP TOP 10

VULNERABLE NODE.JS
PROJECT
▸ https://github.com/cr0hn/vulnerable-node

A1 - INJECTION:
INJECTION FLAWS, SUCH AS SQL, OS, AND
LDAP INJECTION OCCUR WHEN UNTRUSTED
DATA IS SENT TO AN INTERPRETER AS PART
OF A COMMAND OR QUERY. THE ATTACKER’S
HOSTILE DATA CAN TRICK THE INTERPRETER
INTO EXECUTING UNINTENDED COMMANDS
OR ACCESSING DATA WITHOUT PROPER
AUTHORIZATION. OWASP TOP 10
A1 - INJECTION

TEXTO
CODE INJECTION: DEFINITION
▸Those application points with input information, usually from
the user, which must be treated as untrusted by default.
▸Assimilate and understand the expression: This code smells
injection

A1 - INJECTION :: SQL INJECTION (1/5)
SQL INJECTION
function do_auth(username, password) {
var db = pgp(config.db.connectionString);
var q = "SELECT * FROM users WHERE name = '" + username + "' AND password ='" +
password + "';";
return db.one(q);
}
/model/auth.js:4

SQL INJECTION
function do_auth(username, password) {
var q = "SELECT * FROM users WHERE name = '" + username + "' AND password ='" +
password + "';";
return db.one(q);
}
/model/auth.js:4

SQL INJECTION - ATTACK (1/2)

SQL INJECTION - ATTACK (2/2)

SQL INJECTION - SOLUTION
Prepared statement

A1 - INJECTION :: LOG INJECTION (1/3)
LOG INJECTION
router.post('/login/auth', function(req, res) {
var user = req.body.username;
var password = req.body.password;
var returnurl = req.body.returnurl;
logger.error("Tried to login attempt from user = " + user);
/model/login.js:25

LOG INJECTION - ATTACK (1/2)

LOG INJECTION - ATTACK (2/2)

LOG INJECTION - SOLUTION
Use a logging framework, adding variables
as parameters
If you can’t use a framework, remove CR & LR

A1 - INJECTION :: EVIL REGEX (1/4)
EVIL REGEX - EXPLANATION
Regex: ^(a+)+$
Denial Of System (DoS)

EVIL REGEX
var re = /^([a-zA-Z0-9])(([-.]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-
z]{2,3}[.]{1}[a-z]{2,3}))$/
if (!re.test(cart.mail)){
throw new Error("Invalid mail format");
}
/routers/products.js:120

EVIL REGEX - ATTACK
30 seconds

▸ https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
EVIL REGEX - SOLUTION
Use regex as simple as you can
Check each regex before go to production

A2 - BROKEN AUTHENTICATION AND
SESSION MANAGEMENT:
APPLICATION FUNCTIONS RELATED TO
AUTHENTICATION AND SESSION
MANAGEMENT ARE OFTEN NOT IMPLEMENTED
CORRECTLY, ALLOWING ATTACKERS TO
COMPROMISE PASSWORDS, KEYS, OR
SESSION TOKENS, OR TO EXPLOIT OTHER
IMPLEMENTATION FLAWS TO ASSUME OTHER
USERS’ IDENTITIES.
OWASP TOP 10
A2 - BROKEN AUTHENTICATION AND SESSION MANAGEMENT

A2 - BROKEN AUTHENTICATION AND SESSION MANAGEMENT :: COOKIES (1/3)
COOKIES
app.use(session({
secret: 'ñasddfilhpaf78h78032h780g780fg780asg780dsbovncubuyvqy',
cookie: {
secure: false,
maxAge: 99999999999
}
}));
/model/app.js:43

COOKIES

COOKIES - SOLUTION
Enable HTTP-Only
Limite expire time of cookie

A3 - CROSS-SITE SCRIPTING
XSS FLAWS OCCUR WHENEVER AN
APPLICATION TAKES UNTRUSTED DATA AND
SENDS IT TO A WEB BROWSER WITHOUT
PROPER VALIDATION OR ESCAPING. XSS
ALLOWS ATTACKERS TO EXECUTE SCRIPTS IN
THE VICTIM’S BROWSER WHICH CAN HIJACK
USER SESSIONS, DEFACE WEB SITES, OR
REDIRECT THE USER TO MALICIOUS SITES.OWASP TOP 10
A3 - CROSS-SITE SCRIPTING

A3 - CROSS-SITE SCRIPTING (1/4)
XSS
router.get('/products/search', function(req, res, next) {
var url_params = url.parse(req.url, true).query;
var query = url_params.q;
db_products.search(query)
.then(function (data) {
res.render('search', { in_query: query, products: data });
})

XSS
router.get('/products/search', function(req, res, next) {
var url_params = url.parse(req.url, true).query;
var query = url_params.q;
db_products.search(query)
res.render('search', { in_query: query, products: data });
})

XSS - ATTACK

XSS - SOLUTION
▸https://github.com/mdevils/node-html-entities
HTML Entities

A4 - INSECURE DIRECT OBJECT
REFERENCES
A DIRECT OBJECT REFERENCE OCCURS
WHEN A DEVELOPER EXPOSES A REFERENCE
TO AN INTERNAL IMPLEMENTATION OBJECT,
SUCH AS A FILE, DIRECTORY, OR DATABASE
KEY. WITHOUT AN ACCESS CONTROL CHECK
OR OTHER PROTECTION, ATTACKERS CAN
MANIPULATE THESE REFERENCES TO ACCESS
UNAUTHORIZED DATA.
OWASP TOP 10
A4 - INSECURE DIRECT OBJECT REFERENCES

INSECURE DIRECT OBJECT REFERENCES (1/2)
router.all('/products/buy', function(req, res, next) {
cart = {
mail: params.mail,
address: params.address,
ship_date: params.ship_date,
phone: params.phone,
product_id: params.product_id,
product_name: params.product_name,
username: req.session.user_name,
price: params.price.substr(0, params.price.length - 1)}
db_products.purchase(cart)

INSECURE DIRECT OBJECT REFERENCES (2/2)
function purchase(cart) {
var q = "INSERT INTO purchases(mail, product_name, user_name, product_id, address, phone,
ship_date, price) VALUES('" +
cart.mail + "', '" +
cart.product_name + "', '" +
cart.username + "', '" +
cart.product_id + "', '" +
cart.address + "', '" +
cart.ship_date + "', '" +
cart.phone + "', '" +
cart.price +
"');";
return db.one(q);
}
/model/products.js:34
• User ownership check?
• Price check?

INSECURE DIRECT OBJECT REFERENCES -
ATTACK (1/2)

INSECURE DIRECT OBJECT REFERENCES -
SOLUTION
Check database & object references

A6 - SENSITIVE DATA EXPOSURE
MANY WEB APPLICATIONS DO NOT PROPERLY PROTECT
SENSITIVE DATA, SUCH AS CREDIT CARDS, TAX IDS,
AND AUTHENTICATION CREDENTIALS. ATTACKERS MAY
STEAL OR MODIFY SUCH WEAKLY PROTECTED DATA TO
CONDUCT CREDIT CARD FRAUD, IDENTITY THEFT, OR
OTHER CRIMES. SENSITIVE DATA DESERVES EXTRA
PROTECTION SUCH AS ENCRYPTION AT REST OR IN
TRANSIT, AS WELL AS SPECIAL PRECAUTIONS WHEN
EXCHANGED WITH THE BROWSER.
OWASP TOP 10
A6 - SENSITIVE DATA EXPOSURE

A6 - SENSITIVE DATA EXPOSURE (1/4)
SENSITIVE DATA EXPOSURE
auth(user, password)
})
.catch(function (err) {
res.redirect("/login?returnurl=" + returnurl + "&error=" + err.message);
});
/routers/login:39

SENSITIVE DATA EXPOSURE - ATTACK (1/3)

A8 - CROSS-SITE REQUEST FORGERY
A CSRF ATTACK FORCES A LOGGED-ON VICTIM’S
BROWSER TO SEND A FORGED HTTP REQUEST,
INCLUDING THE VICTIM’S SESSION COOKIE AND ANY
OTHER AUTOMATICALLY INCLUDED
AUTHENTICATION INFORMATION, TO A VULNERABLE
WEB APPLICATION. THIS ALLOWS THE ATTACKER TO
FORCE THE VICTIM’S BROWSER TO GENERATE
REQUESTS THE VULNERABLE APPLICATION THINKS
ARE LEGITIMATE REQUESTS FROM THE VICTIM.OWASP TOP 10
A8 - CROSS-SITE REQUEST FORGERY

A8 - CROSS-SITE REQUEST FORGERY (1/6)
CROSS-SITE REQUEST FORGERY
cart = {
mail: params.mail,
price: params.price.substr(0, params.price.length - 1)
}
return res.json({message: "Product purchased correctly"});
});
/routers/products:89

cart = {
mail: params.mail,
price: params.price.substr(0, params.price.length - 1)
}
return res.json({message: "Product purchased correctly"});
});
/routers/products:89
Token?

Buy by GET Request
No token

CROSS-SITE REQUEST FORGERY - ATTACK

CROSS-SITE REQUEST FORGERY - SOLUTION
Use POST requests for actions that modifies
the system.
Use a unique token (CSRF Token) for each
requests that modify the system.

A10 - UNVALIDATED REDIRECTS AND
FORWARDS
WEB APPLICATIONS FREQUENTLY REDIRECT
AND FORWARD USERS TO OTHER PAGES AND
WEBSITES, AND USE UNTRUSTED DATA TO
DETERMINE THE DESTINATION PAGES.
WITHOUT PROPER VALIDATION, ATTACKERS
CAN REDIRECT VICTIMS TO PHISHING OR
MALWARE SITES, OR USE FORWARDS TO
ACCESS UNAUTHORIZED PAGES.
OWASP TOP 10
A10 - UNVALIDATED REDIRECTS AND FORWARDS

A10 - UNVALIDATED REDIRECTS AND FORWARDS (1/4)
UNVALIDATED REDIRECTS AND FORWARDS
if (returnurl == undefined || returnurl == ""){
returnurl = "/";
}
res.redirect(returnurl);
})
/routers/login.js:36

UNVALIDATED REDIRECTS AND FORWARDS
if (returnurl == undefined || returnurl == ""){
returnurl = "/";
}
res.redirect(returnurl);
})
/routers/login.js:36

UNVALIDATED REDIRECTS AND FORWARDS -
ATTACK

UNVALIDATED REDIRECTS AND FORWARDS -
SOLUTION
Only allow relative to domain redirection
White list for redirections

REFERENCIAS
▸OWASP Top 10: https://www.owasp.org/index.php/Top_10_2013-Top_10
▸NodeJS Security check list: https://blog.risingstack.com/node-js-security-checklist/
▸Evil regex:
https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-
_ReDoS
▸Detect potentially evil regex: https://github.com/substack/safe-regex

Security in NodeJS applications

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Security in NodeJS applications

Similar to Security in NodeJS applications (20)

More from Daniel Garcia (a.k.a cr0hn)

More from Daniel Garcia (a.k.a cr0hn) (9)

Recently uploaded

Recently uploaded (20)

Security in NodeJS applications