Researcher Demonstrates Node.js Code Execution Through File Writes on Read-Only Systems

Summary

Stefan Schiller demonstrates how an arbitrary file-write vulnerability can lead to code execution in a Node.js application, even when the root filesystem and procfs are read-only and the application runs with low privileges.

Key points

• The target application allowed user-controlled file paths and contents, but its low-privilege account could write only to an uploads directory.
• The technique writes to an exposed pipe file descriptor through procfs, even when procfs itself is mounted read-only.
• A libuv signal handler processes attacker-supplied pipe data in a way that can lead to a function-pointer invocation.
• The exploit uses existing data and return-oriented programming gadgets in the Node.js image to overcome address randomization constraints.
• The researcher adapted the payload to remain valid UTF-8, including using structure padding to satisfy encoding requirements.
• A demonstration against a sample application produced a reverse shell. Schiller said the approach may also apply to other software using libuv.