0

I am using crack lib to check password strength for my web application. However, I’m concerned about whether or not my current implementation is secure.

The user enters a password, which is then their run through the following node.js code:

      var checkPassword = exec('echo "'+password+ '"| cracklib-check\n', function(err, stdout, stderr) {
     if (stderr) {
        reject(stderr);
     } else if (err) {
        reject(err);
     } else if (stdout) {
        resolve(stdout);            
     } else {
        reject('Password Validation Failed');
     }
  });

because the password is being concatenated into the command, it seems like an attack as possible, Kind of like SQL injection. Is this approach secure, and if not, how do I fix it? If I were to blacklist double quotes, would that avoid all potential issues?

4
  • 1
    Did you mean to wrap that in quotes? As you wrote it, there are no changes to the file system. However, if you wrap that string with double quotes, it adds a file to the filesystem. Oct 27, 2016 at 0:01
  • yes, that could cause problems. can you place it in a temp file and load it from there?
    – dandavis
    Oct 27, 2016 at 3:25
  • I don't understand, place what in a temp file? Oct 27, 2016 at 16:20
  • i mean to put the password in a temp file so that it's not a literal on the shell
    – dandavis
    Oct 27, 2016 at 18:38

1 Answer 1

1

because the password is being concatenated into the command, it seems like an attack as possible, Kind of like SQL injection.

Indeed, it's very easy to do a "; rm -rf / ;"-type attack.

If I were to blacklist double quotes, would that avoid all potential issues?

It's far more secure to avoid passing commands through a shell at all. You should instead be using the exec family of functions (or rather, an appropriate wrapper around them in your language of choice), where you pass a pre-parsed command; this is much more failsafe than trying to implement a shell quoting blacklist. Most language's wrappers will also provide an easy way to pass stdin to the command, which is the only thing you're using multiple processes and a pipeline for.

You still need to consider other possibilities of attack (for instance, does cracklib-check consume a lot of resources when passed a very long string? Then you've opened yourself up to a classic Denial of Service attack), but it will at least avoid the injection-type holes.

2
  • Do you know of any node libraries that are able to handle that task? Oct 28, 2016 at 16:52
  • I'm not familiar with them, but spawn and spawnSync look like the standard type. You want to make sure you don't set the shell parameter to true. Oct 28, 2016 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .