Connect with us
ANE Scholarship
Categories:
X

Technology

Prototype pollution in Blitz.js leads to remote code execution

Published

on

Prototype pollution in Blitz.js leads to remote code execution
Share this post:

Chain of exploits could be triggered without any authentication.

Blitz.js, a JavaScript web application framework, has patched a dangerous prototype pollution vulnerability that could lead to remote code execution (RCE) on Node.js servers.

Prototype pollution is a type of JavaScript vulnerability that allows attackers to exploit the rules of the programming language to change an application’s behavior and compromise it in various ways.

The new bug, discovered and reported by researchers at Sonar, allowed attackers to manipulate the code in the Blitz.js app to create a reverse shell and run arbitrary commands on the server.

Prototype vulnerability in dependencies

“Blitz.js is an upcoming JS framework that gained traction on GitHub,” Paul Gerste, vulnerability researcher at Sonar, told The Daily Swig. “We selected it in order to help secure its code base and study real-world vulnerabilities.”

Blitz is built on top of Next.js, a React-based framework, and adds components to turn it into a full-stack web development platform.

One of the advertised features of Blitz.js is its ‘Zero-API’ layer, which allows the client to invoke server-side business logic through simple functions without the need to write API code.

Blitz.js makes an RPC call to the server in the background and returns the response to the client function call.

“Blitz.js adds an RPC layer on top of Next.js (among other features), and that layer uses superjson to deserialize data from incoming requests. The vulnerability is entirely inside of superjson,” Gerste said.

As an extended version of JSON, superjson adds support for dates, regexes, and circular dependencies. The circular dependency feature allows JSON specifications to reference property names, which caused the prototype vulnerability. An attacker could use these property names to change the running code on the server.

RCE on Blitz servers

Gerste discovered a chain of exploits that could be triggered through the prototype pollution vulnerability and lead to RCE.

First, a polluted JSON request is sent to the server, which triggers the routing mechanism of Blitz.js to load a JavaScript file with the polluted prototype. This allows the attacker to use the malicious JavaScript object to execute arbitrary code.

Ideally, an attacker would create and run a file on the server. But Blitz.js does not support upload functionality. However, it has a CLI wrapper script that uses JavaScript’s spawn() function to launch a new process.

The attacker could use this function to launch a CLI process and run an arbitrary command on the server.

Prototype pollution in Blitz.js

Prototype pollution in Blitz.js

What makes this vulnerability especially dangerous is that it can be triggered without any authentication, which means any user who can access the Blitz.js application will be able to launch RCE attacks.

“An attacker would have the same level of privilege as the vulnerable application,” Gerste said. “So, if the application runs as root, the attacker would also have root privileges.”

Complicated bug

Prototype pollution bugs often act in very complicated ways. For example, in the case of Blitz.js, the CLI wrapper object was not vulnerable per se but could be abused by the prototype pollution bug.

“This attack technique leverages a code pattern that isn’t a vulnerability in itself,” Gerste said. “Prototype pollution can influence the target application in a very invasive way, and it would require a lot of work to get rid of all code that could be influenced by prototype pollution.”

In his write-up of the bug, Gerste gives some general recommendations that can harden JavaScript apps against prototype pollution, including freezing Object.prototype or using the –disable-proto=delete flag in Node.js.

“I think prototype pollution is still unknown to many JavaScript developers,” Gerste said. “I don’t see developers use the patterns that we recommended in our article very often. With our blog posts, we try to help educate JavaScript developers and share this knowledge.”

 


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

News2 hours ago

Segun Showunmi, Ogun PDP: “I will fight this struggle to the end”

News2 hours ago

Plateau PDP nominates former APC chairman as governorship campaign DG

Sports2 hours ago

Officials from Manchester United are in negotiations to sign Joao Felix from Atletico Madrid

Manchester United is teased by Atletico Madrid on their transfer request for Joao Felix
Sports3 hours ago

Manchester United is teased by Atletico Madrid on their transfer request for Joao Felix

Son Heung-min may have been the target of racial remarks when Tottenham and Chelsea drew at the weekend
Sports3 hours ago

Son Heung-min may have been the target of racial remarks when Tottenham and Chelsea drew at the weekend

Sir Jim Ratcliffe, the richest man in Great Britain, expresses interest in purchasing Manchester United
Sports3 hours ago

Sir Jim Ratcliffe, the richest man in Great Britain, expresses interest in purchasing Manchester United

Buhari
News3 hours ago

2023 Budget: Nigerian govt slams N8.52trn for staff salaries, others, Presidency gets N14.2bn

U20WWC: France joins the Falconets from Group C, breaking South Korea's heart.
Sports3 hours ago

U20WWC: France joins the Falconets from Group C, breaking South Korea’s heart.

Apple To Launch iPhone 14 On September 7
Technology4 hours ago

Apple To Launch iPhone 14 On September [See Date]

At London's Soultown Festival, lead performers included Gabrielle, Soul 2 Soul, and Heather Small
Entertainment4 hours ago

At London’s Soultown Festival, lead performers included Gabrielle, Soul 2 Soul, and Heather Small

British billionaire Jim Ratcliffe to buy Man United
Sports4 hours ago

British billionaire, Jim Ratcliffe to buy Man United

U-20 WWC: Super Falconets flogs Canada, to meet Netherlands in quarter-finals
Sports4 hours ago

U-20 WWC: Super Falconets flogs Canada, to meet Netherlands in quarter-finals

Electricity Power Plant
News4 hours ago

National Blackout: Electricity Workers Call Off Strike

Peter Obi Visit Femi Kuti After Threats From Obidients
News4 hours ago

Why I visited Femi Kuti – Peter Obi

House of Reps
News4 hours ago

Reps To Investigate Agric Ministry Over N18.6bn Spent To Clear Bush, Prepare Land

What fans should expect from sequel – "Squid Game" creator
Entertainment7 hours ago

What fans should expect from sequel – “Squid Game” creator

Buju BNXN engages in a near-free-for-all brawl with police officers
Entertainment7 hours ago

Buju has questions to answer, a police spokesman claims, after he boasted of spitting on an officer

Buju BNXN engages in a near-free-for-all brawl with police officers
Entertainment7 hours ago

Buju BNXN engages in a near-free-for-all brawl with police officers

Your daily horoscope for Monday, July 25, 2022
Horoscope7 hours ago

Your daily horoscope for Thursday, August 18, 2022

A robot designed by a snake-loving engineer to restore the reptile's legs
Technology15 hours ago

A robot designed by a snake-loving engineer to restore the reptile’s legs

Technology16 hours ago

WhatsApp is working on a feature that would allow you to retrieve deleted messages

Chaos as students drown while having fun on the Lagos beach
News16 hours ago

Chaos as students drown while having fun on the Lagos beach

News16 hours ago

Ngige convenes an emergency meeting with electricity employees during a blackout.

How Magu botched high-profile corruption cases while pursuing "Yahoo Boys"
News16 hours ago

How Magu botched high-profile corruption cases while pursuing “Yahoo Boys”

Snapchat enables parents to keep an eye on who their kids are messaging on the platform
Technology17 hours ago

Snapchat’s Paid Users Hit 1 Million

Daniel Amah
News17 hours ago

Nigeria Police Officer Rewarded For Rejecting $200,000 Bribe

Cristiano Ronaldo is pushing to leave Manchester United this summer
Sports17 hours ago

Police Caution Ronaldo Over Fan Phone Incident

Hope Uzodinma
News17 hours ago

Peter Obi no threat to APC in Imo – Hope Uzodinma

Peter Obi Visit Femi Kuti After Threats From Obidients
News17 hours ago

Peter Obi Visit Femi Kuti After Threats From Obidients [VIDEO]

Electricity Power Plant
News17 hours ago

Blackout Looms In Nigeria As Electricity Workers Begin Strike

APC
News17 hours ago

APC Fires Bauchi Youth Vanguard

Closed door meeting between Bola Tinubu and Olusegun Obasanjo
News18 hours ago

Closed door meeting between Bola Tinubu and Olusegun Obasanjo

Asisat Oshoala to battle 19 others for 2022 Ballon d'OrAward
Sports21 hours ago

Ballon d’Or nominees who are from Nigeria

La Liga teams rule out signing a Super Eagles forward valued at €30 million
Sports21 hours ago

La Liga teams rule out signing a Super Eagles forward valued at €30 million

Defender Udogie, Super Eagles-eligible defender describes his move to the Premier League as "A dream come true."
Sports21 hours ago

Defender Udogie, Super Eagles-eligible defender describes his move to the Premier League as “A dream come true.”

Cristiano Ronaldo is pushing to leave Manchester United this summer
Sports22 hours ago

Ronaldo slams the media and pledges to tell the “truth” regarding Manchester United’s future.

Beauty BBNaija
Entertainment24 hours ago

BBNaija S7: Beauty apologizes to fans after speaking out about her disqualification

Nigerian singer, Peter Okoye tackles jobless youths who defend people that made them jobless
Entertainment1 day ago

Nigerian singer, Peter Okoye tackles jobless youths who defend people that made them jobless

Moses Armstrong was granted bail after rape allegations
Entertainment1 day ago

Moses Armstrong, the struggling actor, shouts out, “I did not rape anyone.”

Young, Famous & African on Netflix has been renewed for a second season
Entertainment1 day ago

Young, Famous & African on Netflix has been renewed for a second season

Barcelona Finally Register New Signing To La Liga, Lewandowski, Raphinha, Christensen and Kessie
Sports5 days ago

Barcelona Finally Register New Signing To La Liga, Lewandowski, Raphinha, Christensen and Kessie

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Complete Episodes)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Final Episode 14)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 12)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 11)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 10)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 02)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 06)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 08)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 01)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 13)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 03)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 04)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 05)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 07)

MY HOUSEMAID IS A MARINE SPIRIT Story by Adeyanju Faith _ AllNaijaEntertainment
ANE Stories6 days ago

[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 09)

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 01)

Darwin Nunez
Sports6 days ago

James Milner Reveals What Darwin Nunez Did To Liverpool’s Attack

DELILAH'S CURVE story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] DELILAH’S CURVE (Complete Episodes)

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Complete Episodes)

SADE'S HEART TALE
ANE Stories6 days ago

[STORY] SADE’S HEART TALE (Episode 22)

SADE'S HEART TALE
ANE Stories6 days ago

[STORY] SADE’S HEART TALE (Episode 21)

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 06)

Your weekly tarot horoscope for July 24 to July 30 – and Jupiter going retrograde
Horoscope4 days ago

Your weekly tarot horoscope for August 14 to August 20 and Mars entering Gemini

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 04)

NLC
News4 days ago

NLC demands 50% increase in workers’ salaries

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 17)

Soludo
News4 days ago

2023 Elections: Presidential Candidates To Pay ₦10 Million For Campaign Posters In Anambra

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 03)

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 07)

A 12-year-old Nigerian child accidently kills his mother in the United States
News7 days ago

A 12-year-old Nigerian child accidently kills his mother in the United States

Browser-powered desync: Black Hat USA presents a new class of HTTP request smuggling attacks
Technology6 days ago

Browser-powered desync: Black Hat USA presents a new class of HTTP request smuggling attacks

DELILAH'S CURVE story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] DELILAH’S CURVE (Episode 01)

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Final Episode 20)

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 15)

DELILAH'S CURVE story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] DELILAH’S CURVE (Episode 04)

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 09)

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 11)

Images and videos from Mercy Chinwo's wedding ceremony
Entertainment5 days ago

Images and videos from Mercy Chinwo’s wedding ceremony

MY LANDLADY story _ AllNaijaEntertainment
ANE Stories4 days ago

[STORY] MY LANDLADY (Episode 08)

ANE's Billboard Hots



Join "ANE sabi" clique

Don't miss a thing, get ogbonge ANE latest updates to fuel your conversation daily.