1

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that JavaScript is turned on.

Obviously, the client can execute any JavaScript on the server. Now my question is - what vulnerabilities are exposed by allowing the client to execute arbitrary JavaScript on the Server.

The webpage is not only archived, but also all scripts are run for at most 200 milliseconds, after which a screenshot is taken.

Improve this question
3
  • Is the JS ran in a browser or in an interpreter like Node ? In the first case the risk is low, in the second case it's much higher since Node has access by default to the file system and can execute arbitrary commands.
    – user42178
    Commented Oct 27, 2014 at 14:09
  • 1
    Are you running node.js on the server? If not, then your server likely isn't executing any JavaScript. What is going on with the "archiving" process? Are you just parsing the page and downloading the referenced files? Are you passing all JS files to node.js? A little more detail would help.
    – Craine
    Commented Oct 27, 2014 at 14:12
  • All files are downloaded to which the page references (just interpretation and no javascript is involved) and using webkit the page is interpreted and a screenshot is taken and transformed into pdf. We use wkhtmltopdf to turn the webpage in to a pdf. Each request gets 200ms time to allow JavaScript to run.
    – user23127
    Commented Oct 27, 2014 at 15:03

1 Answer 1

Reset to default
3

If any of the pages you've archived on your server contain malicious code targeting webkit vulnerabilities (remember, wkhtmltopdf runs on webkit), it's theoretically possible this will result in a security breach on your server upon running the page through wkhtmltopdf.

The implication here being that malicious code that would normally target your users' client machines is now de facto attacking your server, you'll have to decide for yourself how you rate this risk.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .