How we exploited a code execution vulnerability in math.js

#1

Post by CapacitorSet » Sat, Apr 01, 2017, 5:37 PM UTC

Re: How we exploited a code execution vulnerability in math.js

#2

Post by dvitali » Sat, Apr 01, 2017, 5:41 PM UTC

Good job! Thanks for posting

#3

Post by tbodt » Sun, Apr 02, 2017, 3:11 AM UTC

You can actually get access to require using this bug: cos.constructor("return process.mainModule.require")()

#4

Post by tbodt » Sun, Apr 02, 2017, 3:18 AM UTC

The math.js api appears to be broken right now, it just says "error: method.apply is not a function"

#5

Post by albeebe1 » Sun, Apr 02, 2017, 3:57 AM UTC

That's the definition of a clean presentation. Very clean. Well done.

#6

Post by [deleted] » Sun, Apr 02, 2017, 4:45 AM UTC

[deleted]

#7

Post by comex » Sun, Apr 02, 2017, 5:08 AM UTC

I was bored so I found a bunch more:

#8

Post by frik » Sun, Apr 02, 2017, 5:10 AM UTC

So the vulnerability is online in the service of mathjs.org:

  Math.js is available as a RESTful web service:   http://api.mathjs.org

#9

Post by badminton1 » Sun, Apr 02, 2017, 5:20 AM UTC

EDIT: removed my suggestion since it was unsafe. Thanks for pointing it out.

I was hoping vm to offer you an isolated v8 interpreter without bindings that could used as a sandbox, but this wasn't the case.

#10

Post by catmanjan » Sun, Apr 02, 2017, 5:56 AM UTC

tbodt wrote: post #4

The math.js api appears to be broken right now, it just says "error: method.apply is not a function"

Probably related to the second exploit which used apply.