Node.js
deserialization
Khushal Suthar
7/5/2020

About me
Security Analyst at Net-Square
Khushal Suthar
Twitter: @Khus369
Linkedin: /khus369

Objectives
What is node.js.
What is deserialization.
Exploitation example
1. Exploit - 1 unprotected api
2. Exploit - 2 nodejs
Remediation

In Simple words Node js is “Server-side JavaScript”

What is deserialization
Serialization is a mechanism
of converting the state of an
object into a byte stream.
Deserialization is the reverse
process where the byte
stream is used to recreate
the actual object in memory

Exploit - 1
Unprotected API
Show data
Send GET request for retrieved save serialized data
Create data
Send POST request with json data for serialization.

Payload Create
● arbitrary code execution should occur when untrusted input is
passed into unserialize() function. The best way to create a
payload is to use the serialize() function of the same module.

Payload Create
I created the following JavaScript object and passed it to serialize() function.
Which gives the following output.

Send normal API request, intercept the
request.

Replace the payload

Add the command

And get the response

Example - 2
Node.js deserialization

Payload Create

Load the website

Intercept the request

Decode cookie

Encode payload in base64

Cookie replaced by payload

Get the nc connection

Remediation
● Properly sanitize the input data
○ Use block and replace method
Vulnerable Code

References
● https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-r
emote-code-execution/
● https://hd7exploit.wordpress.com/2017/05/29/exploiting-node-js-deserialization-bug-for-remote-code-ex
ecution-cve-2017-5941/
● https://github.com/hoainam1989/training-application-security/blob/master/shell/node_shell.py

Questions

Thank You!