Common Node.js security vulnerabilities in Node.js - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Cross-Site Scripting (XSS) in Node.js applications?

XSS is a security flaw where attackers inject malicious scripts into web pages viewed by other users. In Node.js apps, this often happens when user input is not properly sanitized before rendering in the browser.

beginner

How can SQL Injection affect a Node.js app?

SQL Injection happens when untrusted user input is directly used in database queries. Attackers can manipulate queries to access or change data they shouldn't. Using parameterized queries or ORM libraries helps prevent this.

beginner

What is the risk of using outdated npm packages in Node.js?

Outdated packages may have known security flaws. Attackers can exploit these to harm your app or steal data. Regularly updating packages and checking for vulnerabilities keeps your app safer.

intermediate

Explain the concept of 'Insecure Deserialization' in Node.js.

Insecure deserialization occurs when untrusted data is converted back into objects without proper checks. Attackers can craft data to execute harmful code or change app behavior. Always validate and sanitize data before deserializing.

beginner

Why is improper error handling a security concern in Node.js?

If error messages reveal too much info (like stack traces or database details), attackers can learn about your app's internals and find weaknesses. Use generic error messages for users and log detailed errors securely.

Which practice helps prevent SQL Injection in Node.js?

A Using parameterized queries

B Ignoring user input

C Storing passwords in plain text

D Disabling HTTPS

Parameterized queries separate code from data, stopping attackers from injecting malicious SQL.

What does XSS allow an attacker to do?

A Crash the Node.js server

B Access server file system directly

C Inject malicious scripts into web pages

D Bypass user login without credentials

XSS lets attackers run harmful scripts in users' browsers by injecting code into web pages.

Why should you keep npm packages updated?

A To fix known security vulnerabilities

B To get new features only

C To increase app size

D To slow down the app

Updating packages patches security holes that attackers might exploit.

What is a sign of improper error handling in Node.js apps?

A Displaying generic error messages

B Showing detailed stack traces to users

C Using try-catch blocks

D Logging errors securely

Detailed errors shown to users can reveal sensitive info useful to attackers.

Insecure deserialization can lead to:

A Better user experience

B Faster app performance

C Automatic updates

D Execution of malicious code

Attackers can craft data that runs harmful code when deserialized without checks.

Describe three common security vulnerabilities in Node.js and how to prevent them.

Think about how attackers exploit user input and dependencies.

Explain why proper error handling is important for Node.js security.

Consider what attackers can learn from error details.

Practice

1. Which of the following is a common security vulnerability in Node.js applications?

easy

A. Memory Leak

B. SQL Injection

C. Slow Network

D. Syntax Error

Solution

1. Step 1: Understand common vulnerabilities

   SQL Injection is a well-known security risk where attackers inject malicious SQL code.

2. Step 2: Identify relevant options

   Memory leaks and slow networks are performance issues, syntax errors are coding mistakes, not security vulnerabilities.

3. Final Answer:

   SQL Injection -> Option B

4. Quick Check:

   Common Node.js security risk = SQL Injection [OK]

Hint: Security risks often involve data injection or unauthorized access [OK]

Common Mistakes:

• Confusing performance issues with security vulnerabilities
• Thinking syntax errors are security problems
• Ignoring injection attacks

2. Which syntax correctly prevents Cross-Site Scripting (XSS) in a Node.js Express app when rendering user input in a template?

easy

A. res.send(`${escape(userInput)}`);

B. res.render('page', { data: userInput });

C. res.send(`${userInput}`);

D. res.send(userInput);

Solution

1. Step 1: Identify safe rendering method

   Escaping user input before inserting into HTML prevents XSS attacks.

2. Step 2: Compare options

   Only res.send(`
   ${escape(userInput)}`); uses an escape function to sanitize input before sending.

3. Final Answer:

   res.send(`
   ${escape(userInput)}
   `); -> Option A

4. Quick Check:

   Escape user input to prevent XSS = res.send(`
   ${escape(userInput)}
   `); [OK]

Hint: Always escape user input before rendering in HTML [OK]

Common Mistakes:

• Sending raw user input directly in HTML
• Assuming template rendering auto-escapes input
• Not using escape functions

3. What will be the output of this Node.js code snippet vulnerable to prototype pollution?

const obj = {};
const payload = JSON.parse('{"__proto__": {"polluted": "yes"}}');
Object.assign(obj, payload);
console.log({}.polluted);

medium

A. Throws an error

B. undefined

C. null

D. "yes"

Solution

1. Step 1: Understand prototype pollution

   Assigning __proto__ property modifies the prototype of all objects.

2. Step 2: Analyze code behavior

   Object.assign merges payload into obj, changing Object prototype to include polluted property.

3. Step 3: Check console.log output

   Accessing {}.polluted reads from prototype, outputs "yes".

4. Final Answer:

   "yes" -> Option D

5. Quick Check:

   Prototype pollution sets property globally = "yes" [OK]

Hint: Prototype pollution changes all objects' properties unexpectedly [OK]

Common Mistakes:

• Expecting undefined instead of polluted value
• Not recognizing __proto__ effect
• Assuming error thrown on prototype pollution

4. Identify the security flaw in this Express middleware code:

app.use((req, res, next) => {
  const token = req.headers['authorization'];
  if (token) {
    req.user = jwt.verify(token, 'secret');
  }
  next();
});

medium

A. Not checking token expiration

B. Using synchronous jwt.verify instead of async

C. Missing error handling for invalid token

D. Not sanitizing user input

Solution

1. Step 1: Review token verification

   jwt.verify can throw if token is invalid, but no try-catch is used.

2. Step 2: Identify missing error handling

   Without try-catch, invalid tokens cause app crash or unhandled exceptions.

3. Final Answer:

   Missing error handling for invalid token -> Option C

4. Quick Check:

   Always catch errors from jwt.verify [OK]

Hint: Wrap jwt.verify in try-catch to handle invalid tokens [OK]

Common Mistakes:

• Ignoring exceptions from jwt.verify
• Assuming synchronous call is insecure
• Confusing input sanitization with token validation

5. You want to secure a Node.js app against outdated package vulnerabilities. Which approach is best to keep dependencies safe?

hard

A. Run 'npm audit' regularly and update vulnerable packages

B. Ignore warnings and only update major versions yearly

C. Manually edit package-lock.json to remove vulnerabilities

D. Use only packages without any dependencies

Solution

1. Step 1: Understand package vulnerability management

   npm audit scans for known vulnerabilities in dependencies.

2. Step 2: Choose best practice

   Regularly running npm audit and updating packages fixes security issues promptly.

3. Step 3: Evaluate other options

   Ignoring warnings risks attacks, manual edits are error-prone, and avoiding dependencies is impractical.

4. Final Answer:

   Run 'npm audit' regularly and update vulnerable packages -> Option A

5. Quick Check:

   Use npm audit and update often = Run 'npm audit' regularly and update vulnerable packages [OK]

Hint: Use npm audit and update packages regularly [OK]

Common Mistakes:

• Ignoring audit warnings
• Editing lock files manually
• Avoiding dependencies completely