TrendMicro Node.js HTTP server listening on localhost can execute commands

Re:TrendMicro Node.js HTTP server listening on localhost can... by smt88 on Monday January 11, 2016 @05:36PM (#10884124)

You misunderstand why people think JS is insecure. The problem is that JS is really easy to make mistakes in because of silent errors, dynamic typing, type coercion, etc.

The result is that your server-side JS is more prone to different kinds of security issues.

On the client side, in the browser, JS is sandboxed, so the language is almost irrelevant. If JS can't actually access the underlying system, no number of bugs make the code insecure.

[ Parent | on HN ]

Re:TrendMicro Node.js HTTP server listening on localhost can... by sangnoir on Tuesday January 12, 2016 @05:28AM (#10886543)

> The problem is that JS is really easy to make mistakes in because of silent errors, dynamic typing, type coercion, etc.

All those are not a factor in this instance. It seems to me it's a result of calling exec() on unscrubbed user input, and this can be done in any language.

[ Parent | on HN ]

Re:TrendMicro Node.js HTTP server listening on localhost can... by smt88 on Tuesday January 12, 2016 @09:34AM (#10887588)

I agree. I was responding to a tangential comment, rather than the root post.

[ Parent | on HN ]