-
-
Notifications
You must be signed in to change notification settings - Fork 345
Description
Is your feature request related to a problem? Please describe.
When deploying to minimal or Mandatory Access Controlled containers a lot of OS commands do not work and should not be required for the function of this library. Even without security concerns spawning processes to read a single file is not efficient.
A 100% replaceable example that is is this, which is completely equivalent to fs.readFileSync except it will be denied in a MAC environment due to the risk of being used as shell injection gadgets off-the-shelf post-exploitation tool would use. And also "cat" without a full path may be subject to PATH-based attacks after initial foothold was obtained, elevating a directory traversal to code execution.
An even if let's say this is not a weakness (which I believe it is, a well-characterized one), a server first popping a shell and then executing cat, grep, df seemingly from nowhere would absolutely trigger IDS systems and lead to an audit in an organizational environment, potentially leading to audit fatigue and ultimately unnecessary risk.
systeminformation/lib/filesystem.js
Lines 141 to 144 in ddced76
| cmd = 'export LC_ALL=C; df -lkPTx squashfs; unset LC_ALL'; | |
| execSync('cat /proc/mounts 2>/dev/null', util.execOptsLinux).toString().split('\n').filter(line => { | |
| return line.startsWith('/'); | |
| }).forEach((line) => { |
Describe the solution you'd like
Only call OS commands when there are truly high maintenance overhead to write equivalent JS implementation (dmidecode, etc) not in commonly used APIs
Describe alternatives you've considered
Not use this package or whitelist commands the package uses (I personally don't recommend and did not take this route).
Additional context
Audit log (at the very least cat and grep should not be needed IMO):
DENIED misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/cat comm=sh requested_mask=x denied_mask=x
DENIED misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/df comm=sh requested_mask=x denied_mask=x
DENIED misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/grep comm=sh requested_mask=x denied_mask=x