Skip to content

Reduce dependencies on OS commands for security and efficiency concerns #977

@eternal-flame-AD

Description

@eternal-flame-AD

Is your feature request related to a problem? Please describe.

When deploying to minimal or Mandatory Access Controlled containers a lot of OS commands do not work and should not be required for the function of this library. Even without security concerns spawning processes to read a single file is not efficient.

A 100% replaceable example that is is this, which is completely equivalent to fs.readFileSync except it will be denied in a MAC environment due to the risk of being used as shell injection gadgets off-the-shelf post-exploitation tool would use. And also "cat" without a full path may be subject to PATH-based attacks after initial foothold was obtained, elevating a directory traversal to code execution.

An even if let's say this is not a weakness (which I believe it is, a well-characterized one), a server first popping a shell and then executing cat, grep, df seemingly from nowhere would absolutely trigger IDS systems and lead to an audit in an organizational environment, potentially leading to audit fatigue and ultimately unnecessary risk.

cmd = 'export LC_ALL=C; df -lkPTx squashfs; unset LC_ALL';
execSync('cat /proc/mounts 2>/dev/null', util.execOptsLinux).toString().split('\n').filter(line => {
return line.startsWith('/');
}).forEach((line) => {

Describe the solution you'd like

Only call OS commands when there are truly high maintenance overhead to write equivalent JS implementation (dmidecode, etc) not in commonly used APIs

Describe alternatives you've considered

Not use this package or whitelist commands the package uses (I personally don't recommend and did not take this route).

Additional context

Calling code: https://github.com/misskey-dev/misskey/blob/5ed1101bbda9d6e9c03d39c106e0da868e1d419b/packages/backend/src/server/api/endpoints/admin/server-info.ts#L115-L118

Audit log (at the very least cat and grep should not be needed IMO):

DENIED  misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/cat comm=sh requested_mask=x denied_mask=x
DENIED  misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/df comm=sh requested_mask=x denied_mask=x
DENIED  misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/grep comm=sh requested_mask=x denied_mask=x

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions