1

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that JavaScript is turned on.

Obviously, the client can execute any JavaScript on the server. Now my question is - what vulnerabilities are exposed by allowing the client to execute arbitrary JavaScript on the Server.

The webpage is not only archived, but also all scripts are run for at most 200 milliseconds, after which a screenshot is taken.

  • Is the JS ran in a browser or in an interpreter like Node ? In the first case the risk is low, in the second case it's much higher since Node has access by default to the file system and can execute arbitrary commands. – user42178 Oct 27 '14 at 14:09
  • 1
    Are you running node.js on the server? If not, then your server likely isn't executing any JavaScript. What is going on with the "archiving" process? Are you just parsing the page and downloading the referenced files? Are you passing all JS files to node.js? A little more detail would help. – Craine Oct 27 '14 at 14:12
  • All files are downloaded to which the page references (just interpretation and no javascript is involved) and using webkit the page is interpreted and a screenshot is taken and transformed into pdf. We use wkhtmltopdf to turn the webpage in to a pdf. Each request gets 200ms time to allow JavaScript to run. – user23127 Oct 27 '14 at 15:03
3

If any of the pages you've archived on your server contain malicious code targeting webkit vulnerabilities (remember, wkhtmltopdf runs on webkit), it's theoretically possible this will result in a security breach on your server upon running the page through wkhtmltopdf.

The implication here being that malicious code that would normally target your users' client machines is now de facto attacking your server, you'll have to decide for yourself how you rate this risk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.