5 ms·

What if the author snuck his code into frontend modules, and also snuck his code into backend modules? If CSP is enabled, the frontend checks to see if the ba

What if the author snuck his code into frontend modules, and also snuck his code into backend modules? If CSP is enabled, the frontend checks to see if the backend code has opened up the particular port or route on the backend. The back-end code could sniff through require.cache to see if he could hook into the existing server instance ( same port ), or open a new port ( depending on CSP ). I suppose the CSP equivalent on the backend is some sort of firewall. I also suppose servers have better monitoring of requests. Still, this method would circumvent CSP!!! Also, hooking into the existing server instance would throw red flags if the instance was ever console.logged. You might also do an audit of your ports and see a suspicious one opened in that method. And a firewall likely would block other ports. But, still, it's feasible even with a CSP, until discovered.

danschumann 9y ago
Actually, a main question is this: can npm modules read require.cache? If so, why? Can they require code outside of the npm modules folder. Again, why? Couldn't any npm module steal your credentials, and suffer from the same source minification/github custody stuff? Take an npm module. It does setInterval and every minute, it checks require.cache for any file with 'config' in it, and sends it to the crook. Is this possible currently? I would think npm modules should be require-sandboxed to their own directory. Even then, there is compiled code, etc. Oy vey.
- vjeux 9y ago
  You don’t need to do such complex things. You can just require(‘child_process’).execSync(‘any shell command’) with all the user credentials.
saryant 9y ago
He'd have to somehow make outbound requests from the server. IIRC, the default AWS VPC config would prevent this. Not sure about other cloud environments. Where I work, outbound requests must be made through proxy servers which have a whitelisted set of allowed domains, which is only allowed after a security review.
- deleted 9y ago
  [deleted]
- tyingq 9y ago
  You can exfiltrate data a number of ways though. DNS requests might be one obvious method.
  - mwarkentin 9y ago
    AWS has GuardDuty now which can monitor for this type of traffic for pretty cheap.
- true_tuna 9y ago
  AWS default VPC config whe does not block outbound by default. Neither in the security group nor the ACL. And of the half dozen AWS hosted startups I’ve worked for nobody restricts outbound yet. “Security nice to have, not prioritized yet”
bubble_boi 9y ago
Author here. Someone in a comment pointed out that you if you could get your code in express middleware (or something depended on by express middleware or similar) you could potentially alter any CSP header in the responses (if it's set in middleware before your's in the chain).
- tlrobinson 9y ago
  Indeed. Then the middleware could also inject exfiltration JavaScript in `text/html` or `application/javascript` responses, which would work even if the app doesn’t use npm modules on the frontend. This applies to almost any backend web framework and package manager, but the culture of micro packages in npm suits itself well to this attack.
  - tlrobinson 9y ago
    Clearly what we need is cryptographically-signed JavaScript and CSP pinning. (I’m only half joking) EDIT: oh, CSP pinning is actually a thing that’s been proposed https://www.w3.org/TR/csp-pinning/ https://www.w3.org/TR/csp-pinning/

danschumann 9y ago

Actually, a main question is this: can npm modules read require.cache? If so, why? Can they require code outside of the npm modules folder. Again, why? Couldn't any npm module steal your credentials, and suffer from the same source minification/github custody stuff? Take an npm module. It does setInterval and every minute, it checks require.cache for any file with 'config' in it, and sends it to the crook. Is this possible currently? I would think npm modules should be require-sandboxed to their own directory. Even then, there is compiled code, etc. Oy vey.

vjeux 9y ago
You don’t need to do such complex things. You can just require(‘child_process’).execSync(‘any shell command’) with all the user credentials.

saryant 9y ago

He'd have to somehow make outbound requests from the server. IIRC, the default AWS VPC config would prevent this. Not sure about other cloud environments. Where I work, outbound requests must be made through proxy servers which have a whitelisted set of allowed domains, which is only allowed after a security review.

deleted 9y ago
[deleted]
tyingq 9y ago
You can exfiltrate data a number of ways though. DNS requests might be one obvious method.
- mwarkentin 9y ago
  AWS has GuardDuty now which can monitor for this type of traffic for pretty cheap.
true_tuna 9y ago
AWS default VPC config whe does not block outbound by default. Neither in the security group nor the ACL. And of the half dozen AWS hosted startups I’ve worked for nobody restricts outbound yet. “Security nice to have, not prioritized yet”

bubble_boi 9y ago

Author here. Someone in a comment pointed out that you if you could get your code in express middleware (or something depended on by express middleware or similar) you could potentially alter any CSP header in the responses (if it's set in middleware before your's in the chain).

tlrobinson 9y ago
Indeed. Then the middleware could also inject exfiltration JavaScript in `text/html` or `application/javascript` responses, which would work even if the app doesn’t use npm modules on the frontend. This applies to almost any backend web framework and package manager, but the culture of micro packages in npm suits itself well to this attack.
- tlrobinson 9y ago
  Clearly what we need is cryptographically-signed JavaScript and CSP pinning. (I’m only half joking) EDIT: oh, CSP pinning is actually a thing that’s been proposed https://www.w3.org/TR/csp-pinning/ https://www.w3.org/TR/csp-pinning/