Many IoT devices run variations of JavaScript code to help alleviate hardware resource consumption. Sometimes, this code is also running on the device when it needs to act as a server for certain use cases. There are great tools that scan project directories for known vulnerable JavaScript versions used in the project. First, we will have a look at RetireJS.
- To run RetireJS, simply run the retire command and specify the JavaScript directory as follows:
$ retire path/to/js/
Loading from cache: https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json
Loading from cache: https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/npmrepository.json
/static/js/lib/jquery-ui.js
jquery-ui-dialog ...
