Title:
Potential RCE Exploitation Attempt In NodeJS
Status:
test
Description:Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.
References:
-https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
Author: Moti Harmats
Date: 2023-02-11
modified:None
Tags:
- -'attack.initial-access'
- -'attack.t1190'
Logsource:
- category: application
- product: nodejs
- definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)
Detection:
keywords:
- 'node:child_process'
condition:
keywords
Falsepositives:
-Puppeteer invocation exceptions often contain child_process related errors, that doesn't necessarily mean that the app is vulnerable.
Level:
high
