Hacking Websites: NodeJS Server-Side Template Injection
Source: YouTube · John Hammond · published Oct 30, 2023 · 23:16
This video demonstrates how to exploit a server-side template injection vulnerability in a web application using EJS templating to read sensitive files and gain code execution 8:01-9:53.
Key Takeaways:
• The color profile application allows users to set a profile color but manually implements template replacement instead of using EJS properly, creating an injection vulnerability 8:01-9:53
• By analyzing the source code and network requests, the injection point is identified in the profile color parameter 1:19-1:59
• Testing with basic expressions like 7+7 confirms the injection works, returning 14 in the page source 12:03-15:57
• Using global.process.mainModule.require('fs').readFileSync('flag.txt') successfully reads the flag file from the server 16:55-20:35
• The vulnerability can be escalated to full code execution by requiring the child process module and running system commands 21:25-21:56
The video highlights the importance of properly implementing templating engines to prevent server-side template injection vulnerabilities 0:00-0:14.
Sources:
- 0:00-0:14 Introduction to the vulnerable color profile web application
- 1:19-1:59 Analyzing network requests to identify the injection point
- 8:01-9:53 Examining the vulnerable server code implementation
- 12:03-15:57 Testing the vulnerability with basic expressions
- 16:55-20:35
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
this simple web application allows you to set a color for your profile picture with this color wheel picker but it has a vulnerability and can be hacked this is one of the challenges from the sneak fetch the flag CTF competition that I co-hosted with sneak this past weekend over on the challenges page this is the color profile warm-ups challenge that had 143 solves by the end of the game a little bit surprised it didn't have more it is one of the warm-ups challenges but the description here is use a beautiful color wheel to update your profile we have a file to download which should be the source code of the application we can go ahead and download that now and in the top right we have a start button where we can go ahead and spin up a dynamic service or the container and instance for us t…