Re:Remote code execution in cdnjs of Cloudflare
by MattIPv4 on Friday July 16, 2021 @08:04AM
(#27855412)
> But how would you manage to create a malicious library and have it approved by cdnjs? That's the part of the exploit that sounds the hardest, and I don't see a reasonable way to go about it.
1. Hijack an existing library to publish the malicious version
2. or, Have us approve what looks like a legitimate library, which later publishes a malicious version
Re:Remote code execution in cdnjs of Cloudflare
by teddyh on Friday July 16, 2021 @09:20AM
(#27855931)
> 1. Hijack an existing library
Hijack or buy outright an existing library. IIRC, there have been many such instances where existing projects have been sold for large sums to questionable parties.
Re:Remote code execution in cdnjs of Cloudflare
by NotEvil on Friday July 16, 2021 @10:31AM
(#27856599)
As I understand it. Every library in npm registry (they library you can install using npm) are also automatically approved ( which sounds reasonable you don't want to approve every library by hand).
And that's what the author exploits by registering a library that have a symlink in it. Which then got excuted.
So, let me see if I get this straight...
cdnjs is a CDN for javascript libraries. cdnjs has a "library update server", in which an "auto-update script" runs periodically to update the libraries that the CDN offers. If it finds a new version of a library, it downloads the files from the library's git repository, and it publishes them on the CDN.
There can be symlinks in git repositories, but the "auto-update script" doesn't handle them correctly. And that's the core of the vulnerability.
If you own the git repository of a library published by cdnjs, you could add a symlink to the git repository. The symlink could point to a file that you want to access on the cdnjs "library update server". Then, as soon as the "auto-update script" runs, the file's contents will be public to everyone on the CDN.
But how would you manage to create a malicious library and have it approved by cdnjs? That's the part of the exploit that sounds the hardest, and I don't see a reasonable way to go about it.