Backdoor injected to NPM express-cookies package

#1

Post by ekke » Wed, May 02, 2018, 8:26 AM UTC

Remote code injection vulnerability wild in public npm package, plausible-sounding 'express-cookies' and its dependency 'getcookies'. >10K downloads during April.

Vulnerable code: https://npm.runkit.com/getcookies/test/harness.js?t=1525249320108

https://www.npmjs.com/package/express-cookies

Re: Backdoor injected to NPM express-cookies package

#2

Post by fuckyouzilla » Wed, May 02, 2018, 9:16 AM UTC

Proofs?

Re: Backdoor injected to NPM express-cookies package

#3

Post by jononor » Wed, May 02, 2018, 10:31 AM UTC

No links to git repo in the packages, big warning sign.

Re: Backdoor injected to NPM express-cookies package

#4

Post by seanwhitsell » Wed, May 02, 2018, 1:01 PM UTC

jononor wrote: post #3

No links to git repo in the packages, big warning sign.

Suspiciously good looking profile pic for the developer too; https://www.google.com/search?tbs=sbi:AMhZZite6RvKwDFjIobMX-...

Re: Backdoor injected to NPM express-cookies package

#5

Post by cathhhhji » Wed, May 02, 2018, 2:10 PM UTC

There is no reason to use "express-cookies" when "cookie-parser" exists.

Re: Backdoor injected to NPM express-cookies package

#6

Post by ekke » Wed, May 02, 2018, 2:29 PM UTC

And NPM took it down quickly, whew.

Re: Backdoor injected to NPM express-cookies package

#7

Post by jononor » Wed, May 02, 2018, 2:31 PM UTC

Can someone explain how the injection itself works? I assume it's the require doing the work, but its not so clear how that loads externally instead of from a path in filesystem?

Re: Backdoor injected to NPM express-cookies package

#8

Post by mindcrash » Wed, May 02, 2018, 4:35 PM UTC

seanwhitsell wrote: post #4

jononor wrote: post #3

No links to git repo in the packages, big warning sign.

Suspiciously good looking profile pic for the developer too; https://www.google.com/search?tbs=sbi:AMhZZite6RvKwDFjIobMX-...

Because it's a crop from a stock photo with a male model (in fact, see the first image result on the page).

Re: Backdoor injected to NPM express-cookies package

#9

Post by dylz » Wed, May 02, 2018, 11:48 PM UTC

jononor wrote: post #7

Can someone explain how the injection itself works? I assume it's the require doing the work, but its not so clear how that loads externally instead of from a path in filesystem?

It appears to be middleware that looks at headers, and if a certain condition is met, it'll basically execute https://nodejs.org/api/vm.html#vm_vm_runinthiscontext_code_o... against whatever the header has.

Re: Backdoor injected to NPM express-cookies package

#10

Post by hinkley » Thu, May 03, 2018, 3:45 AM UTC

cathhhhji wrote: post #5

There is no reason to use "express-cookies" when "cookie-parser" exists.

Express just ejected a bunch of its functionality into “express-“ modules.