GHSA-78p3-fwcq-62c2 @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution  by manipulating `lang` and  `defstring` parameters when setting localizer strings
SummaryThe endpoint `/site-structure/localizer/save-string/:lang/:defstring` accepts two parameter values: `lang` and `defstring`. These values are used in an unsafe way to set the keys and value of the `cfgStrings` object. It allows to add/modify properties of the `Object prototype` that result in several logic issues, including:RCE vulnerabilities by polluting the `tempRootFolder` propertySQL injection vulnerabilities by polluting the `schema` property when using `PostgreSQL` database.Detailsfile: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/infoarch.js#L236-L239PoCSetup:set `SALTCORN_NWORKERS=1` before starting the `saltcorn` server (to easily observe the behavior of the PoC)make sure to use PostgresSQL backendlogin with a user with admin permissionRCEThis PoC demonstrates how to escalate the Prototype Pollution vulnerability to change the behavior of certain command executed.check that the file that will be created does not exists:pollute the `Object.prototype` with a `tempRootFolder` value set to `;echo+"rce"|tee+/tmp/RCE;` by sending the following request *** :visit `http://localhost:3000/plugins/new`enter the following fields:Name: `test`Source: `git`other fields blankclick `Create`you will get an error but the command `echo "rce" | tee /tmp/RCE` will be executedto verify:The RCE occurs because after the previous curl request, the `tempRootFolder` property is set to `;echo+"rce"|tee+/tmp/RCE;` that is later used to build the shell commands.file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L45-L58SQL InjectionThis PoC demonstrates how to escalate the Prototype Pollution vulnerability to change the behavior of certain SQL queries (i.e SQLi).visit `http://localhost:3000/table` to check the page returns some results (no errors)pollute the `Object.prototype` with a schema value set to `"` (just to create an exception in the query that will be executed to demonstrate the issue) by sending the following request *** :visit again `http://localhost:3000/table` but this time an SQL error will appear:**NOTE**: Another payload to use as `value` could be `pg_user"+WHERE+1=1+AND+(SELECT+pg_sleep(5))+IS+NOT+NULL+--`The SQL injection occurs because after the previous curl request, the `schema` property is set to `"`.file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/postgres/postgres.js#L101*** Retrieve valid values for the `connect.sid` (`VALID_CONNECT_SID_COOKIE`) and `_csrf` values (`VALID_csrf_Value`) :open the browser developer console and go to the `Network` tabvisit `http://localhost:3000/site-structure/localizer/add-lang`add a language (`Name: test` , `Locale: test`) and click `Save`under the `Network` tab, filter for `save-lang` and check the request parameters (`Headers` and `Payload`/`Request` tabs)copy the values for `connect.sid` and `_csrf` and paste in the curl command aboveImpactRemote code execution (RCE), Sql injection and business logic errors.Recommended MitigationCheck the values of `lang` and  `defstring` parameters against dangerous properties like `__proto__`, `constructor`, `prototype`.
CVSS v4.0 score: 7.3
CVSS v3.1 score: 7.2