Executive brief
Bassmaster is a Node.js plugin that enables batch processing of multiple HTTP requests in a single call. A critical vulnerability in versions up to 1.5.1 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript code on the server through maliciously crafted batch requests. This could lead to complete server compromise, data theft, or service disruption.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the batch request processor where user-supplied input from request paths is directly evaluated using JavaScript's eval() function without proper sanitization. An attacker can craft a POST request to the batch endpoint with specially crafted path parameters containing JavaScript code that breaks out of the intended string context and executes arbitrary commands. The attack requires network access to the batch endpoint (typically /batch) but no prior authentication. Successful exploitation grants the attacker arbitrary code execution with the privileges of the Node.js process. The fix, released in version 1.5.2, removes the unsafe eval() statement. A Metasploit module (EDB-ID 40689) and public proof-of-concept code demonstrate reliable exploitation.
Affected products
- npm bassmaster <=1.5.1
Timeline
- 2014: disclosed: Vulnerability discovered in bassmaster 1.5.1
- 2014: patched: Fixed in bassmaster 1.5.2 by removing eval statement
- 2017-10-24: advisory: GHSA-5j3g-jfq3-7jwx published
- 2016-11-02: exploited: Metasploit exploit module (EDB-ID 40689) released