Stranger Danger: Your Node.js Attack Surface Just Got Bigger
summary
Live hacking shows a vulnerable marked markdown parser (4 million monthly downloads) enabling XSS via an escape/regex gap, an unauthenticated NoSQL injection in real Rocket.Chat code pattern, and a container built from a legacy Node 6 base image that imports image‑magic flaws (about 252 CVEs) so an uploaded image triggers a shell action and creates files. A Node runtime path‑traversal lets the running container expose server files, and upgrading the base image and patching marked are the demonstrated remediations.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:48Future of Open Source Security
- 4:59Software Supply Chain Security
- 5:32Compromised Maintainers
- 8:18Node Js Active Development
- 11:04Middleware Signature Function
- 14:19Nosql Injection Attack
- 33:16Cross-Site Scripting Vulnerability
- 40:37Image Magic Vulnerability
- 48:44Improper Input Validation
related talks
29mA Node.js Security Roadmap
47mNode.js Security: Breaking The Loop
41mLive Hacking: Breaking into Your Web App
46mHow to hack a node app?
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
40mHow to hack a node app?
47mBlack Clouds and Silver Linings in Node.js Security