Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 14 submissions in the queue.
posted by hubie on Monday April 11 2022, @01:19AM   Printer-friendly
from the the-kingdoms-of-experience dept.

Bundled version of Node.js simplifies executing downloaded code

Adobe Creative Cloud Experience, a service installed via the Creative Cloud installer for Windows, includes a Node.js executable that can be abused to infect and compromise a victim's PC.

Michael Taggart, a security researcher, recently demonstrated that the node.exe instance accompanying Adobe's service could be exploited by writing a simple proof-of-concept JavaScript file that spawns the Windows Calculator app.

"I have confirmed that the node.exe packaged with the Adobe Customer Experience service can run any JavaScript you point it to," he explained to The Register.

[. . .] Security researchers commenting on Taggart's finding said they'd been under the impression the bundled Node runtime would only execute files signed by Adobe, but evidently that's not the case.

[. . .] "Because the JavaScript is getting invoked by path in C:\Program Files, it would be extremely difficult to detect from a monitoring/threat hunting perspective," explained Taggart, who added that he was able to get his own custom file dropper to run and execute a command-and-control agent without any warning from Windows Defender.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Touché) by Anonymous Coward on Monday April 11 2022, @10:04AM

    by Anonymous Coward on Monday April 11 2022, @10:04AM (#1236132)

    an attacker without some other vulnerability to exploit would need to induce the victim to download and run the script. But its availability does make it easier to mount an attack and to conceal that anyone has done so.

    OMG, did that "security researcher" warn us about the dangers of cmd.exe, cscript.exe and powershell too?

    Seriously, if the attacker can already do that they can get the victim to run other stuff too.

    Maybe he should also go point out similar Linux "vulnerabilities" - /bin/sh /bin/bash /usr/bin/perl /usr/bin/python etc

    Starting Score:    0  points
    Moderation   +3  
       Insightful=1, Touché=2, Total=3
    Extra 'Touché' Modifier   0  

    Total Score:   3