2 ms·
Well, skimming the vulnerabilities [1] didn't really see anything too interesting. Consider this "eval_remote" vulnerability: var e = require("express");
by javajosh 11y ago
Well, skimming the vulnerabilities [1] didn't really see anything too interesting. Consider this "eval_remote" vulnerability:
var e = require("express");
var DVNA = e();
DVNA.get('/', function(req, res) {
var res = eval("("+req.query.e+")");
res.send('Parameter eval():<br> ' + res);
});
DVNA.listen(6666);
Yes, if you eval your requests that is a vulnerability, but it is a trivial one. I was expecting some side-channel esoteric stuff that, reading the code, you wouldn't necessarily see the problem.
1 - https://github.com/quantumfoam/DVNA/tree/master/vulnerabilities https://github.com/quantumfoam/DVNA/tree/master/vulnerabilit...