A6 Sensitive Data Exposure about nodegoat HOT 2 CLOSED

Source code disclosure using public directory middleware. Possible in express, restify, connect, koa etc if configured incorrectly.

Directory structure

- /fonts
- /images
- /scripts
- /stylesheets
- /index.html
- /app.js

app.js

var express = require('express');
var app = express();

// expose fonts, stylesheets etc to the front end
app.use(express.static(__dirname));

app.listen(1234);

Now the client side app can be loaded at http://localhost:3000. Fonts and scripts can be referenced in index.html using http://localhost:3000/fonts or http://localhost:3000/scripts. However, it also exposes sensitive files such as package.json or app.js (this file) or any other file in the app directory. Imagine things such as config files, model or controller code etc. Yikes!

from nodegoat.

Not sure what the theme of the application is but sensitive data exposure using cookies might be useful.

Simple - unencrypted cookies

var express = require('express');
var app = express();

app.use(express.cookieParser());

app.use(function(req, res) {
    res.cookie('secret', 'data');
});

app.listen(1234);

Complex - Weak or default encryption passphrase

var express = require('express');
var app = express();

app.use(express.cookieParser('secret'));

app.use(function(req, res) {

    // we've added a passphrase key but our cookie can still be cracked if the cookie data is relatively small
    res.cookie('total_price', '100', { signed: true });
});

app.listen(1234);

We can crack the cookie since we know the HMAC algorithm (algorithm and key are prepended to the cookie value). Method: base64 decode, then use node crypto functions to crack the cookie and/or generate our own :). The key thing with this would be to ensure we use a simple cookie value such as a common password or a small integer.

It would be nice to include another gotcha somewhere around explicitly setting signed: true when creating the cookie if the cookie is secret. Otherwise, the cookie is not encrypted. Not a very safe default!

P.S I am just throwing ideas out there since I don't have access to Google Groups forum and dont know the process for getting stuff into the app. Happy to send pull requests as well.

from nodegoat.