Node.js child_process.fork 与 env 污染 RCE

1
const express = require("express");
2
const bodyParser = require("body-parser");
3
const proc = require("child_process");
4
const request = require("request");
5
const ip = require("ip");
6
const manage = require("./manage.js");
7
const path = require("path");
8

9
const app = express();
10
app.use(bodyParser.urlencoded({ extended: true }));
11
app.use(bodyParser.json());
12

13
app.use(express.static(path.join(__dirname, "public")));
14

15
//stop hackers
16
const disallowedKeys = [
17
  "__proto__",
18
  "prototype",
19
  "constructor",
20
  "eval",
21
  "proccess",
22
  "root",
23
  "global",
24
  "exec",
25
  "!",
26
  "fs",
27
];
28

29
function isValidPath(segment) {
30
  disallowedKeys.forEach(evilWord => {
31
    if (segment.toString().indexOf(evilWord) !== -1) {
32
      return false;
33
    }
34
  });
35

36
  return true;
37
}
38

39
app.post("/add", (req, res) => {
40
  let ip = req.ip;
41
  console.log(ip.m);
42
  if (ip.substr(0, 7) == "::ffff:") {
43
    ip = ip.substr(7);
44
  }
45
  console.log(`method:${req.method},serverip:${server_ip},ip:${ip}`);
46

47
  if (ip != "127.0.0.1" && ip != server_ip) {
48
    res.status(403).send("Not Edit from Local!");
49
  } else {
50
    if (req.body.userName && req.body.nameVal) {
51
      let username = req.body.userName;
52
      let nameVal = req.body.nameVal;
53

54
      if (!isValidPath(username) || !isValidPath(nameVal)) {
55
        username = "username";
56
        nameVal = "guest";
57
      }
58

59
      manage.set(object, username, nameVal);
60
      console.log(ip.k);
61
      console.log(object);
62

63
      res.send(`
64
            <h1>Edit Success</h1>
65
            <a href="/admin">View Admin Page</a>`);
66
    } else {
67
      res.send("param error");
68
    }
69
  }
70
});
71

72
app.get("/admin", (req, res) => {
73
  if (manage.get(object, "username", "guest") === "admin") {
74
    console.log("Current User:" + object.username);
75

76
    const child = proc.fork(`${__dirname}/public/user.js`, ["admin"]);
77
    child.on("message", body => {
78
      res.status(200).send(body);
79
    });
80
    child.on("close", (code, signal) => {
81
      console.log(`subproccess ended with ${signal}`);
82
    });
83
  } else {
84
    res.status(403).send("Only Admin Can View this");
85
  }
86
});
87

88
app.get("/getContent", (req, res) => {
89
  res.sendfile(`${__dirname}/public/guest.html`);
90
});
91

92
app.get("/", (req, res) => {
93
  // console.log(req.body)
94
  let uri = req.query.url ? req.query.url : "http://127.0.0.1:3000/getContent";
95
  console.log(uri);
96

97
  try {
98
    request.get(uri, (err, response, data) => {
99
      if (!err && response.statusCode == 200) {
100
        res.send(data);
101
      } else {
102
        console.log(err);
103
      }
104
    });
105
  } catch (e) {
106
    console.log(e);
107
  } finally {
108
    console.log("Make Server Continue Running");
109
  }
110
});
111

112
var object = { username: "guest" };
113
var server_ip = ip.address();
114

115
app.listen(3002);
116
console.log(`${server_ip} is starting at port 3000`);

1
const isObj = require("is-obj");
2

3
var manage = {
4
  getPathSegments: function (path) {
5
    const pathArray = path.split(".");
6
    const parts = [];
7

8
    for (let i = 0; i < pathArray.length; i++) {
9
      let p = pathArray[i];
10

11
      while (p[p.length - 1] === "\\" && pathArray[i + 1] !== undefined) {
12
        p = p.slice(0, -1);
13
        p += pathArray[++i];
14
      }
15

16
      parts.push(p);
17
    }
18

19
    return parts;
20
  },
21

22
  get: function (object, path, value) {
23
    if (!isObj(object) || typeof path !== "string") {
24
      return value === undefined ? object : value;
25
    }
26

27
    const pathArray = this.getPathSegments(path);
28

29
    for (let i = 0; i < pathArray.length; i++) {
30
      if (!Object.prototype.propertyIsEnumerable.call(object, pathArray[i])) {
31
        return value;
32
      }
33

34
      object = object[pathArray[i]];
35

36
      if (object === undefined || object === null) {
37
        if (i !== pathArray.length - 1) {
38
          return value;
39
        }
40
        break;
41
      }
42
    }
43

44
    return object;
45
  },
46

47
  set: function (object, path, value) {
48
    Object.keys(Object.prototype).forEach(function (Val) {
49
      if (!Object.hasOwnProperty(Val)) {
50
        delete Object.prototype[Val];
51
        console.log(`${Val} is delete`);
52
      }
53
    });
54

55
    if (!isObj(object) || typeof path !== "string") {
56
      return object;
57
    }
58

59
    const root = object;
60
    const pathArray = this.getPathSegments(path);
61

62
    for (let i = 0; i < pathArray.length; i++) {
63
      const p = pathArray[i];
64

65
      if (!isObj(object[p])) {
66
        object[p] = {};
67
      }
68

69
      if (i === pathArray.length - 1) {
70
        object[p] = value;
71
      }
72

73
      object = object[p];
74
    }
75

76
    return root;
77
  },
78
};
79

80
module.exports = manage;