2018年3月29日のブックマーク (1件)

  • CVE-2018-7160 - Pwning (NodeJS) Developers

    TL;DR:  NodeJS in debug mode did not check the Origin-Header of websocket connections. This could lead to arbitrary code execution on victims systems if they visited a malicious website while debugging NodeJS. Visual Studio Code 1.19 - 1.19.2 was running in debug mode by default and exposed all users to this vulnerability. Due to my suspiciousness against 3rd party software (probably a side effect

    jovi0608
    jovi0608 2018/03/29
    今朝修正されたDNSリバインディングを使ったNode inspectorの脆弱性POC解説。攻撃サイトに接続後127.0.0.1にDNS変更しNodeのデバッガに接続。UUID取得しwsのDevToolプロトコル使いexecSyncで任意のコマンドを実行。