A critical vulnerability has been identified in the Cloudflare content delivery network cdnjs, which is intended to accelerate the delivery of JavaScript libraries, allowing arbitrary code execution on the CDN servers. The severity of the issue is exacerbated by the fact that approximately 12.7% of websites on the internet utilize the service for loading JavaScript libraries, and compromising the infrastructure allows for the replacement of libraries served by any of these sites.
The cdnjs service loads packages from Git or the NPM repository, after which it allows any site to use the Cloudflare content delivery network for free to speed up the loading of JavaScript libraries. Upon examining the code of the cdnjs components published on GitHub, it was found that the standard archive/tar module in Go is used for unpacking NPM packages from tgz archives, which outputs a list of files as is, without normalizing paths. When the script unpacks content based on the provided list, the presence of files in the archive such as "..\/..\/..\/..\/..\/..\/..\/tmp\/test" can lead to the overwriting of arbitrary files on the system, depending on access permissions.
It was assumed that an attacker could apply to add their library to cdnjs and upload a specially crafted archive to the NPM repository, containing files with "..\/" characters in the path. On the cdnjs servers, an "autoupdate" operation is periodically performed, during which the handler downloads new versions of the proposed library and unpacks the contents. By using files with "..\/" paths, the attacker can achieve the overwriting of service scripts and execute their code on server which the unpacking was performed.
In the case of updates being loaded from Git, it was found that the update-loading handler did not take symbolic links into account when copying files from Git. This feature allowed for the reading of any files with server by adding symbolic links in Git.
Experiments with the demonstration of a cdnjs hack for a bounty on HackerOne began with testing a hypothesis regarding file reading. A symbolic link test.js was added to the Git repository of the CDN-served JavaScript library, pointing to the file /proc/self/maps. After a new version of the library was published, the update handler processed this repository and published the specified file in cdnjs (test.js was created as a symbolic link and when this file was requested, the content of /proc/self/maps was returned).
By substituting a symbolic link to the file /proc/self/environ, the author of the study noticed that the returned data contained the values of the environment variables GITHUB_REPO_API_KEY and WORKERS_KV_API_TOKEN. The first variable held the API key for write access to the robocdnjs repository on GitHub. The second variable stored the token for the KV store in cdnjs. Using the obtained information, an attacker could make changes to cdnjs and completely compromise the infrastructure.
Source: opennet.ru
