msgpack-CVE-2021-23410-test

var assert = require('assert');
var msgpack = require('msgpack');
function sleep(ms) {
  return new Promise((resolve) => {
    setTimeout(resolve, ms);
  });
}
async function init() {
  var normal = { "a": 1, "b": 2, "c": [1, 2, 3] };
  var malicious = msgpack.pack({
    exploit: function () {
      // Note(by @azu): This Poc just run child_process.exec
      // It is not related to msgpack
      require('child_process').exec('echo code_executed!;sleep 3', function (error, stdout, stderr) {
        console.log(stdout)
      });
    }(),
  });
  var rce = msgpack.unpack(malicious);
  assert.deepEqual(rce, normal);
}

init();

git clone [email protected]:azu/msgpack-CVE-2021-23410-test.git
cd msgpack-CVE-2021-23410-test
npm install
npm test