Security Research

node-serialize Deserialization RCE: An Underestimated Trust Chain in a Node.js Library

Thinking 2024-01-15 5 min read Research Dossier
#Vulnerability Analysis#Code Audit#Malware

The tiny serialization library node-serialize, last released as 0.0.4, left one backdoor in its unserialize() function — any JSON field whose value starts with _$$ND_FUNC$$_ is fed straight into eval(). The result is arbitrary Node.js code execution.

Unlock to view this content.