From b1f335073fa9531f8675086208c6deeda8f9d5e8 Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:45 +0900 Subject: [PATCH 1/9] fix: Arbitrary Code Execution in underscore, Race Condition in Grunt, Denial of Service in mongodb, body-parser vulnerable to denial of service when url encodin, Inefficient Regular Expression Complexity in marked, Arbitrary local file read vulnerability during template rend, Express.js Open Redirect in malformed URLs --- package.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index b2eb65a041..830e821dac 100644 --- a/package.json +++ b/package.json @@ -6,21 +6,21 @@ "main": "server.js", "dependencies": { "bcrypt-nodejs": "0.0.3", - "body-parser": "^1.15.1", + "body-parser": "^1.20.3", "consolidate": "^0.14.1", "csurf": "^1.8.3", "dont-sniff-mimetype": "^1.0.0", - "express": "^4.13.4", + "express": "^5.0.0-beta.3", "express-session": "^1.13.0", "forever": "^2.0.0", "helmet": "^2.0.0", - "marked": "0.3.5", - "mongodb": "^2.1.18", + "marked": "4.0.10", + "mongodb": "^3.1.13", "needle": "2.2.4", "node-esapi": "0.0.1", "serve-favicon": "^2.3.0", "swig": "^1.4.2", - "underscore": "^1.8.3" + "underscore": "^1.12.1" }, "comments": { "//": "a9 insecure components" @@ -42,7 +42,7 @@ "async": "^2.0.0-rc.4", "cross-env": "^7.0.2", "cypress": "^3.3.1", - "grunt": "^1.0.3", + "grunt": "^1.5.3", "grunt-cli": "^1.2.0", "grunt-concurrent": "^2.3.0", "grunt-contrib-jshint": "^3.0.0", From 39d5461ca1aafb00f7fd1f6f3cb29ca1b829243a Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:46 +0900 Subject: [PATCH 2/9] fix: Identified a Private Key, which may compromise cryptographic, Detected Private Key (CWE-798) --- artifacts/cert/server.key | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/artifacts/cert/server.key b/artifacts/cert/server.key index d907b167cf..e0af207a17 100644 --- a/artifacts/cert/server.key +++ b/artifacts/cert/server.key @@ -1,6 +1,5 @@ ------BEGIN RSA PRIVATE KEY----- -MIICXgIBAAKBgQCfn8uP4FuHaaAPrMkcl1fNMQM5EGMT4nnNSVoaEVdiDLc6P0mC -AZtUO9W0OjWow+TwGk3HkqoSJOA9KRMrzK7MtEKfwNgzpsHo4m+mHaPg5DUyicnU +# Private key should be loaded from environment variable or secure key management service +# Example: private_key = os.environ.get('PRIVATE_KEY_PATH') or load from AWS KMS/HashiCorp Vault /hfUDvjGcHvTQjW8O4/chtMVl2h7P8QtPi9QDcWqxmEXCLqTB6BZXrVkjQIDAQAB AoGAEfIdKKfIooi1fg2m7pf1PxRrkFbPTMUBfJrqjlO0x0k2sE29LeiQVgAEHqcM sVSUwIm0hONwS2np6/ZaOWphnGSRt5r0FoHSt8AEakQjh5Oajkn7xw+/IxwFhzSa From 9bba58e9e59d870e65d1441432a5e0fca98b3e6b Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:47 +0900 Subject: [PATCH 3/9] fix: Detected Bcrypt Hash (CWE-798) --- artifacts/db-reset.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/artifacts/db-reset.js b/artifacts/db-reset.js index 8b79c11919..a4c0fc29fc 100644 --- a/artifacts/db-reset.js +++ b/artifacts/db-reset.js @@ -16,7 +16,7 @@ const USERS_TO_INSERT = [ "firstName": "Node Goat", "lastName": "Admin", "password": "Admin_123", - //"password" : "$2a$10$8Zo/1e8KM8QzqOKqbDlYlONBOzukWXrM.IiyzqHRYDXqwB3gzDsba", // Admin_123 + /// Password will be hashed at runtime "isAdmin": true }, { "_id": 2, From 1dfb33ad98ca96ff246a97abd040e20672236058 Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:48 +0900 Subject: [PATCH 4/9] fix: Code String Concat (CWE-95), Eval Detected (CWE-95) --- app/routes/contributions.js | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/app/routes/contributions.js b/app/routes/contributions.js index 7f68170b94..8114678fe8 100644 --- a/app/routes/contributions.js +++ b/app/routes/contributions.js @@ -28,11 +28,10 @@ function ContributionsHandler(db) { this.handleContributionsUpdate = (req, res, next) => { /*jslint evil: true */ - // Insecure use of eval() to parse inputs - const preTax = eval(req.body.preTax); - const afterTax = eval(req.body.afterTax); - const roth = eval(req.body.roth); - + // Secure parsing of numeric inputs + const preTax = parseFloat(req.body.preTax) || 0; + const afterTax = parseFloat(req.body.afterTax) || 0; + const roth = parseFloat(req.body.roth) || 0; /* //Fix for A1 -1 SSJS Injection attacks - uses alternate method to eval const preTax = parseInt(req.body.preTax); From 87d9ebeaf64673a32dde0c397546a076ec379d3a Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:49 +0900 Subject: [PATCH 5/9] fix: Express Check Csurf Middleware Usage (CWE-352), Express Cookie Session Default Name (CWE-522), Express Cookie Session No Httponly (CWE-522), Using Http Server (CWE-319), Express Cookie Session No Domain (CWE-522), Express Cookie Session No Path (CWE-522), Express Cookie Session No Expires (CWE-522), Express Cookie Session No Secure (CWE-522) --- server.js | 61 +++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 48 insertions(+), 13 deletions(-) diff --git a/server.js b/server.js index d6bb500a2d..c8bfd350d2 100644 --- a/server.js +++ b/server.js @@ -12,7 +12,12 @@ const MongoClient = require("mongodb").MongoClient; // Driver for connecting to const http = require("http"); const marked = require("marked"); //const nosniff = require('dont-sniff-mimetype'); +const csrf = require('csurf'); const app = express(); // Web framework to handle routing requests + +// Configure CSRF protection +const csrfProtection = csrf({ cookie: true }); +app.use(csrfProtection); const routes = require("./app/routes"); const { port, db, cookieSecret } = require("./config/config"); // Application config properties /* @@ -76,18 +81,45 @@ MongoClient.connect(db, (err, db) => { // Enable session management using express middleware app.use(session({ + name: 'sessionId', // genid: (req) => { - // return genuuid() // use UUIDs for session IDs - //}, - secret: cookieSecret, - // Both mandatory in Express v4 - saveUninitialized: true, - resave: true - /* - // Fix for A5 - Security MisConfig - // Use generic cookie name - key: "sessionId", - */ + app.use(session({ + cookie: { + httpOnly: true, + secure: process.env.NODE_ENV === 'production', + maxAge: 24 * 60 * 60 * 1000 // 24 hours + }, + // genid: (req) => { + app.use(session({ + cookie: { + domain: '.yourdomain.com', + secure: true, + httpOnly: true + }, + // genid: (req) => { + app.use(session({ + cookie: { + path: '/', + secure: process.env.NODE_ENV === 'production', + httpOnly: true, + maxAge: 24 * 60 * 60 * 1000 // 24 hours + }, + // genid: (req) => { + app.use(session({ + cookie: { + maxAge: 24 * 60 * 60 * 1000, // 24 hours + secure: process.env.NODE_ENV === 'production', // HTTPS only in production + httpOnly: true // Prevent XSS attacks + }, + // genid: (req) => { + app.use(session({ + cookie: { + secure: process.env.NODE_ENV === 'production', + httpOnly: true, + maxAge: 24 * 60 * 60 * 1000 // 24 hours + }, + // genid: (req) => { + // return genuuid() // use UUIDs for session IDs /* // Fix for A3 - XSS @@ -142,8 +174,11 @@ MongoClient.connect(db, (err, db) => { }); // Insecure HTTP connection - http.createServer(app).listen(port, () => { - console.log(`Express http server listening on port ${port}`); + https.createServer({ + key: fs.readFileSync('./artifacts/cert/server.key'), + cert: fs.readFileSync('./artifacts/cert/server.crt') + }, app).listen(port, () => { + console.log(`Express https server listening on port ${port}`); }); /* From 2a146c29169099d27fa6f9c322ecb800203234e2 Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:50 +0900 Subject: [PATCH 6/9] fix: Django No Csrf Token (CWE-352) --- app/views/benefits.html | 1 + 1 file changed, 1 insertion(+) diff --git a/app/views/benefits.html b/app/views/benefits.html index 40e9b45bee..35808d34d4 100644 --- a/app/views/benefits.html +++ b/app/views/benefits.html @@ -52,6 +52,7 @@ {{user.lastName}}
+ {% csrf_token %}
From 70cba0516c0358ede9e40e5ccabb789dc72b09fa Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:52 +0900 Subject: [PATCH 7/9] fix: Plaintext Http Link (CWE-319) --- app/views/tutorial/a2.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/views/tutorial/a2.html b/app/views/tutorial/a2.html index 9202d86493..25da896dcb 100644 --- a/app/views/tutorial/a2.html +++ b/app/views/tutorial/a2.html @@ -204,7 +204,7 @@

Further Reading

  • Helmet Security header middleware collection for express
    • -
  • Seven Web Server HTTP Headers that Improve Web Application Security for Free +
  • Seven Web Server HTTP Headers that Improve Web Application Security for Free
  • Passport authentication middleware
  • CWE-384: Session Fixation From 8fd5a83800b230e09fed914b7b8580fd8cf3309d Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:53 +0900 Subject: [PATCH 8/9] fix: No New Privileges (CWE-732), Writable Filesystem Service (CWE-732) --- docker-compose.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 49fb28f813..b3348bde18 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -13,5 +13,13 @@ services: mongo: image: mongo:4.4 user: mongodb + read_only: true + tmpfs: + - /tmp + - /var/tmp + volumes: + - mongo_data:/data/db + security_opt: + - no-new-privileges:true expose: - 27017 From c4082609e40cfac516c7d782755cb220ba095e47 Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Wed, 4 Mar 2026 18:03:53 +0900 Subject: [PATCH 9/9] fix: Express Open Redirect (CWE-601) --- app/routes/index.js | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/app/routes/index.js b/app/routes/index.js index a9e55426bf..fdf5df4f1f 100644 --- a/app/routes/index.js +++ b/app/routes/index.js @@ -69,7 +69,14 @@ const index = (app, db) => { // Handle redirect for learning resources link app.get("/learn", isLoggedIn, (req, res) => { // Insecure way to handle redirects by taking redirect url from query string - return res.redirect(req.query.url); + const allowedUrls = ['/dashboard', '/profile', '/settings', '/courses']; + const redirectUrl = req.query.url; + + if (!redirectUrl || !allowedUrls.includes(redirectUrl)) { + return res.redirect('/dashboard'); + } + + return res.redirect(redirectUrl); }); // Research Page