Securing Node Applications

Chapter 1. Injection Attacks

Injection vulnerabilities are the most prevalent and dangerous of web application vulnerabilities. Typically, an injection vulnerability manifests when application code sends untrusted user input to an interpreter as part of a command or query. Attackers exploit the vulnerability by crafting hostile data that tricks the interpreter into executing unintended commands or accessing data without proper authorization.

In this chapter, we review two prevailing mechanisms of injection attacks: command and database.

Command Injection

Using command injection, an attacker can execute arbitrary commands on the host operating system of a vulnerable application. This flaw gives enormous opportunities to an attacker, ranging from reading restricted file contents to installing malware with which the attacker can take full control of the server and host network.

Attack Mechanics

The child_process core module enables Node developers to invoke underlying OS commands from the application code. Due to its name and simplicity of use, the child_process.exec method is commonly used for making system calls.

The exec method takes three arguments: a command in string format, an optional options object, and a callback function, as demonstrated in Example 1-1.

Example 1-1. child_process.exec command

child_process.exec(command[, options][, callback])

Although the exec method executes OS commands in a nonblocking manner, perfectly aligning with Node’s async programming paradigm, ...