Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Frequency of Known Vulnerabilities in JavaScript

snyk.io

Post reply on HN
Print view View original

41–50 of 58 posts

Re: The Frequency of Known Vulnerabilities in JavaScript

#41

Post by scandox »

jamiesonbecker wrote: post #37
scandox wrote: post #26

Earlier quoted context omitted.

Indeed there is. Most often a token, stored in localStorage. But that token can be used from anywhere and with any mechanism. So I guess what I mean is that if there is a way for somebody to intercept or retrieve it, then I have in the past viewed that as a vulnerability of the browser (probably wrongly). So what I'd love to understand better is the kind of attacks that would be practical, and how they would exploit…

Your humility is pretty awesome. As a simple example, paste alert("haha") into an form in your system that will (eventually) be viewable to someone else. Let's say it's something innocuous like the quantity field on an order form or a comment on a comment form. Now, none of those characters will attack your database through SQL injection, right? So what happens when you (the administrator) views your latest orders? B…

Humility is all I've got :)

Re: The Frequency of Known Vulnerabilities in JavaScript

#42

Post by RKoutnik »

ghiculescu wrote: post #3

In ruby land, there's a great gem - https://github.com/rubysec/bundler-audit - that lets you know when specific gem versions have a known security vulnerability. We run it as part of our CI. When a vulnerability drops, it gets fixed pretty quickly since otherwise everyone's build fails. Does anyone know of any equivalents for the JS world? A quick google finds https://github.com/nodesecurity/nsp but keen to hear what…

Snyk, the site hosting this article, provide such a service: https://snyk.io/

Re: The Frequency of Known Vulnerabilities in JavaScript

#43

Post by steveax »

scandox wrote: post #36
mi100hael wrote: post #28

Earlier quoted context omitted.

Ever heard of XSS?

Yes but what I think I had not given enough thought to were DOM-based vulnerabilities, which it seems to me are the ones that would be relevant to 3rd party JS libs. Anyway I will certainly be giving this deeper thought.

If you're for instance relying on handlebars to escape displayed content from user input properly and your version has a vulnerability...

Re: The Frequency of Known Vulnerabilities in JavaScript

#44

Post by et-al »

jamiesonbecker wrote: post #38
ng12 wrote: post #34

Earlier quoted context omitted.

But I don't think jQuery vulnerabilities could possibly open you up to XSS attacks unless you were already doing something silly.

something like.. var comment = " alert(1) "; $("div.comments").append(comment); not so silly.

This example will only affect that particular user viewing the page, though. And once they hit refresh, that'll be gone.

If I'm following your other example with malicious input into a form; the snippet would have to pass server-side validation (likely, since it's probably checking for SQL injects). Then past that, when it gets rendered for other users, the view/templating would need to display the snippet as a script instead of just text, right?

Re: The Frequency of Known Vulnerabilities in JavaScript

#45

Post by godmodus »

peterwwillis wrote: post #21
godmodus wrote: post #13

Earlier quoted context omitted.

been a "word" since forever mate, i even remember using it in the 90s. and it's alright, you might just be young or haven't forayed much into the deeper corners of the web where 'vulns' get discussed.

did you see that noobs box get pwnd by that js vuln? what a waste of a 0day. luldongues

Well we didn't use luldongues where I hanged out, but beyond that, pretty accurate for a clean, leetspeak free version :P

Ahh, it's been awhile since I was 16.

Re: The Frequency of Known Vulnerabilities in JavaScript

#46

Post by edejong »

heroprotagonist wrote: post #39

Does 398 vulnerabilities in NPM seem low? https://snyk.io/vuln?type=npm

Although it seems pedantic, it is important to note that these are 398 publicly known vulnerabilities. An easily overlooked distinction. (Small edit due to style).

Re: The Frequency of Known Vulnerabilities in JavaScript

#47

Post by ubernostrum »

narsil wrote: post #16
ghiculescu wrote: post #3

In ruby land, there's a great gem - https://github.com/rubysec/bundler-audit - that lets you know when specific gem versions have a known security vulnerability. We run it as part of our CI. When a vulnerability drops, it gets fixed pretty quickly since otherwise everyone's build fails. Does anyone know of any equivalents for the JS world? A quick google finds https://github.com/nodesecurity/nsp but keen to hear what…

Nice. Is there an equivalent for Python? A quick Google search doesn't seem to pull up anything obvious.

See https://requires.io/ for this as a service with source-control integration.

Re: The Frequency of Known Vulnerabilities in JavaScript

#48

Post by chiliap2 »

The article lists https://snyk.io/vuln/npm:moment:20161019 as an example of a vulnerability (although not one that is tracked). Could someone explain how a Javascript vulnerability could cause a DDoS? Even if it does cause Moment to hang, how would that affect the server?

Re: The Frequency of Known Vulnerabilities in JavaScript

#49

Post by AgentME »

ng12 wrote: post #40
jamiesonbecker wrote: post #38

Earlier quoted context omitted.

something like.. var comment = " alert(1) "; $("div.comments").append(comment); not so silly.

It is silly if the content of `comment` is coming from an external source (e.g. query string). Could you identify a specific jQuery vulnerability that makes otherwise safe code unsafe?

I wouldn't say that jQuery has a vulnerability, but it having tons of APIs that have an overloard supporting injecting HTML from a string make it easy to write vulnerable code (compare to React where the only way to inject HTML from a string requires using a very explicit API involving typing "unsafe") and hard to identify vulnerable code (I can't easily ctrl-f through a codebase for easy-to-misuse functions because most of the calls will be calls to safer-element-taking overloads that I can only identify by following the code backwards).

Re: The Frequency of Known Vulnerabilities in JavaScript

#50

Post by tmikaeld »

chiliap2 wrote: post #48

The article lists https://snyk.io/vuln/npm:moment:20161019 as an example of a vulnerability (although not one that is tracked). Could someone explain how a Javascript vulnerability could cause a DDoS? Even if it does cause Moment to hang, how would that affect the server?

A simple Ajax loop would certainly stress the server when run on a lot of clients.
Post reply on HN