doc: annotate server.js with extra info regarding session and static …

[cfabianski]

Express uses a middleware system to execute code, modify requests and responses, and perform other tasks whenever a network action takes place. The order you define these middleware matters. From the express documentation:

The order of middleware loading is important: middleware functions that are loaded first are also executed first.

This is the problem we can look for. Here's an example of what not to do:

app.use(session());
app.use(express.static(__dirname + '/public'));

In this case, the session handler is initialized before returning a static asset.

Instead, we want to confirm that the static asset middleware, express.static is set prior to the session middleware.

app.use(express.static(__dirname + '/public'));
// any other middelware
app.use(session());

This will serve static assets as expected, but not apply the session middleware to them since it is defined later.

Links

• https://twitter.com/vhmth/status/1633631115113103362?s=20
• https://www.loom.com/blog/march-7-incident-update

[lirantal]

@cfabianski thanks for adding and noting the context with the links.

Would there be an actual viable exploit we can demonstrate based on the vulnerable code here?

[cfabianski]

Would there be an actual viable exploit we can demonstrate based on the vulnerable code here?

That's a very good point. I'll think about it 🤔

[lirantal]

If there are any updates, I'm happy to pick this up with you, potentially to also write a short demo with this?