Server-Side JavaScript Injection

What it is

Server-Side JavaScript Injection (SSJI) occurs when a Node.js application evaluates user-supplied input as JavaScript code. Functions like eval(), new Function(), setTimeout() with string arguments, and require() with user-controlled paths create injection opportunities. Successful exploitation can result in remote code execution, data exfiltration, or full server compromise.

Attack Vectors

• Applications using eval() on user input
• Template engines backed by JavaScript evaluation
• Calculator or expression evaluator features
• JSON deserialization with eval-based parsers
• Dynamic require() calls with user-controlled module names

Testing Methodology

1. Submit 1+1 and observe if 2 is returned (arithmetic evaluation)
2. Test with process.version to detect Node.js context
3. Try require('child_process').execSync('id').toString()
4. Use global object enumeration: Object.keys(global)

Indicators of Vulnerability

• Arithmetic result returned for injected expression
• Node.js version string in response for process.version
• File system contents or environment variables in response

Detection Guidance

Audit all uses of eval(), new Function(), and similar evaluation primitives in Node.js code. Static analysis tools can identify these patterns.

Mitigation & Remediation

• Never use eval() or new Function() with user-supplied input
• Use JSON.parse() instead of eval() for JSON data
• Implement strict Content Security Policy
• Use vm module with a restricted sandbox if evaluation is truly necessary
• Apply principle of least privilege to Node.js process

References

• OWASP SSJI Testing
• OWASP Hunting — Server-Side JavaScript Injection (upstream)