HEXACON2024 – Exploiting File Writes in Hardened Environments by Stefan Schiller

Summary: The video discusses a vulnerability research presentation by Stefan, focusing on how arbitrary file write vulnerabilities can be exploited in Node.js applications. He describes various types of vulnerabilities, specifically highlighting a method by which a low-privileged user can achieve remote code execution despite having restricted file access.

Keypoints:

Stefan is a vulnerability researcher at Sonar’s R&D team, responsible for discovering and reporting zero-day vulnerabilities in popular open-source software.

Common web application vulnerabilities include command injection, cross-site scripting, and SQL injection.

Arbitrary file write (AFW) vulnerabilities can often lead to remote code execution (RCE), but mitigating factors, such as read-only file systems, can complicate exploitation.

The presentation focuses on a specific node.js AFW vulnerability where both the file path and content are user-controllable.

Many paths to execute code from AFW vulnerabilities typically involve writing scripts or sensitive files, but in this case, permissions were restrictive.

The concept of “everything is a file” in UNIX systems allows the exploitation of various system resources, treated as files, through the virtual file system.

procfs, a special-purpose file system in Linux, can allow modifications to certain system-level configurations and potential code execution through techniques like modifying the core dump pattern.

Pipes, utilized in Node.js for inter-thread communication, are accessible via procfs, opening another avenue for exploitation.

Stefan demonstrates how Node.js’s asynchronous, non-blocking nature can be leveraged by writing specially crafted data structures to pipes, leading to function pointer manipulation.

Despite challenges such as Address Space Layout Randomization (ASLR), the research indicates that static addresses in Node.js can be exploited for arbitrary code execution.

He discusses methods to find suitable memory addresses for gadgets within Node.js to execute ROP chains, despite facing encoding challenges due to UTF-8 restrictions.

The presentation concludes with a demonstration of an exploit that successfully gains a reverse shell on a vulnerable Node.js application.

Stefan emphasizes that the principles discussed may apply beyond Node.js to other software using similar libraries, suggesting a broader impact of the findings.