Learn the concepts of Node.js deserialization based attack scenarios.

1. Node.js
deserialization
Khushal Suthar
7/5/2020

2. About me
Security Analyst at Net-Square
Khushal Suthar
Twitter: @Khus369
Linkedin: /khus369

3. Objectives
What is node.js.
What is deserialization.
Exploitation example
1. Exploit - 1 unprotected api
2. Exploit - 2 nodejs
Remediation

4. In Simple words Node js is “Server-side JavaScript”

5. What is deserialization
Serialization is a mechanism
of converting the state of an
object into a byte stream.
Deserialization is the reverse
process where the byte
stream is used to recreate
the actual object in memory

6. Exploit - 1
Unprotected API
Show data
Send GET request for retrieved save serialized data
Create data
Send POST request with json data for serialization.

7. Payload Create
● arbitrary code execution should occur when untrusted input is
passed into unserialize() function. The best way to create a
payload is to use the serialize() function of the same module.

8. Payload Create
I created the following JavaScript object and passed it to serialize() function.
Which gives the following output.

9. Send normal API request, intercept the
request.

10. Replace the payload

11. Add the command

12. And get the response

13. Example - 2
Node.js deserialization

14. Payload Create

15. Load the website

16. Intercept the request

17. Decode cookie

18. Encode payload in base64

19. Cookie replaced by payload

20. Get the nc connection

21. Remediation
● Properly sanitize the input data
○ Use block and replace method
Vulnerable Code

22. References
● https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-r
emote-code-execution/
● https://hd7exploit.wordpress.com/2017/05/29/exploiting-node-js-deserialization-bug-for-remote-code-ex
ecution-cve-2017-5941/
● https://github.com/hoainam1989/training-application-security/blob/master/shell/node_shell.py

23. Questions

24. Thank You!