Node.js HFS Command Execution Vulnerability (CVE-2024-39943)

White Hat School 3rd – Jeongmin Noh (@JenmrR)

Summary

In a Node.js-based HFS server environment, there is a vulnerability where the content of an uploaded file is executed via child_process.execSync().
An attacker can directly execute OS commands through the file upload feature, and can check the results of internal server commands or control the system.
This vulnerability corresponds to CVE-2024-39943 and poses a threat equivalent to command injection (Remote Code Execution).

Environment Setup and Execution

1. Run the server using Docker environment
2. The server receives file uploads at the /upload path and executes the uploaded file content as a command
3. The attacker can achieve RCE through upload

Execution Flow

$ sudo docker-compose up --build -d