Node.js Serialization - PentesterLab Writeup

Node.js unserialize vulnerability and IIFE function execution.

🖥️ Challenge / Machine Info

  • Platform: pentesterlab
  • Name / Title: node-serialize
  • Difficulty: Hard
  • Target OS / Environment: Web
  • Key Vulnerability Focus: Node.js serialization RCE

Walkthrough

  1. Construct a serialized JS object containing an Immediately Invoked Function Expression (IIFE).
  2. Pass the serialized object in the cookie parameter to trigger automatic remote execution on parse.