Detections

Analysis of Node.js Trust Falls: Dangerous Module Resolution on Windows

Node.js Dangerous Module Resolution Path Abuse on Windows

sigma · generated; parse required before publication

title: Node.js Dangerous Module Resolution Path Abuse on Windows
description: Detects Node.js loading untrusted native modules or scripts from current
  working directories or world-writable paths.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    Image: '*\node.exe'
    CommandLine: '*node_modules*\\..\\*'
  condition: selection
level: medium
tags: []
references: []

VULN_NodeJS_Windows_ModuleTraversal

yara · compile required before publication

rule VULN_NodeJS_Windows_ModuleTraversal {
  strings:
    $s1 = "require('../../AppData/Local/Temp/exploit.node')" ascii wide nocase
    $s2 = "process.dlopen_insecure" ascii wide nocase
    $s3 = "NODE_PATH_SEARCH_HIJACK" ascii wide nocase
  condition:
    any of them
}