Course 39 - NodeJS Security Pentesting and Exploitation | Episode 2: Mitigating RCE, OS Injection, and Path Traversal Vulnerabilities

In this lesson, you’ll learn about: critical Node.js vulnerabilities caused by unsafe user input handling, including RCE, command injection, XSS, and directory traversal1. Core Security Principle🔹 Key idea:
Never trust user input👉 Any data from users must be treated as hostile by default
Without validation, it can become a direct execution path into the system.2. Remote Code Execution (RCE) via eval()🔹 Dangerous functions:

• eval()
• setTimeout()
• setInterval()
• new Function()

• Infinite loops → server crash (DoS)
• Forced termination (process.exit())
• Full server takeover (reverse shell execution)

• child_process.exec

• Input is passed into shell commands
• Attacker injects separators like ;
• Extra commands execute on the OS

• Read sensitive files (e.g., system password data)
• Execute arbitrary system commands

• execFile
• spawn

• Script execution in victim’s browser
• Session hijacking potential
• UI manipulation

• ../
• repeated directory jumps

• Access files outside intended directory
• Read sensitive system files
• Break application file boundaries

• Input is executed instead of validated
• System commands are built from raw strings
• Output is rendered without escaping
• File paths are not restricted