Shellshock in Feathersjs with Jwt Tokens

Shellshock (CVE-2014-6271 and related variants) is a vulnerability in Bash that allows arbitrary code execution through specially crafted environment variables. In FeathersJS applications that use JWT tokens for authentication, Shellshock can be exposed when the server deserializes or validates tokens in a way that invokes shell commands or passes untrusted input into shell contexts.

FeathersJS is a framework for building REST and real-time APIs with Node.js. When JWT tokens are used, the server typically verifies the token, extracts the payload, and attaches the user to the request. If the application or a plugin invokes shell commands—such as calling exec, spawn, or child_process functions—using data derived from the JWT payload (e.g., user roles, permissions, or identifiers), an attacker can inject malicious shell code via environment variables or command arguments. This can occur when the server uses dynamic command construction or unsafe interpolation of token claims into shell-executed scripts.

For example, if a FeathersJS service uses a hook that runs a shell command to log or enforce policies based on JWT claims, and those claims are not strictly validated or sanitized, an attacker who obtains or guesses a valid JWT can include specially crafted environment variables that execute arbitrary commands when the shell is invoked. This represents a critical security risk because it can lead to full server compromise.

middleBrick detects this class of issue by testing input validation and unsafe consumption behaviors across the unauthenticated attack surface. It checks whether endpoints that accept JWT tokens reflect or process shell-invoking patterns and flags findings where token data could reach shell execution paths without strict sanitization.

To mitigate Shellshock risks when using JWT tokens in FeathersJS, ensure that JWT claims are never directly used in shell commands. Validate and sanitize all inputs, and avoid shell execution entirely when handling token-derived data. Below are concrete code examples demonstrating secure practices.

Example 1: Safe JWT verification and payload usage without shell execution

const feathers = require('@feathersjs/feathers');
const authentication = require('@feathersjs/authentication');
const jwt = require('@feathersjs/authentication-jwt');

const app = feathers();

app.configure(authentication({
  secret: 'your-super-secret-key',
  strategies: ['jwt']
}));

app.configure(jwt());

// A service that uses JWT payload safely
app.use('/messages', {
  async create(data, params) {
    const { user } = params;
    // user is populated from JWT payload after authentication
    // Use user data directly as an object, not in a shell command
    return {
      text: data.text,
      createdBy: user._id,
      timestamp: Date.now()
    };
  }
}));

Example 2: Avoiding shell injection when logging or external commands are necessary

const { execFile } = require('child_process');
const feathers = require('@feathersjs/feathers');

const app = feathers();

app.use('/report', {
  async before(context) {
    const { user } = context.params;
    // DO NOT construct shell commands with user data
    // Instead, pass arguments directly to execFile with an array
    const sanitizedRole = Array.isArray(user.roles) ? user.roles[0] : 'user';
    // Validate and restrict to expected values
    const validRoles = ['admin', 'user', 'guest'];
    if (!validRoles.includes(sanitizedRole)) {
      throw new Error('Invalid role');
    }
    // Use execFile with explicit arguments, avoiding shell interpretation
    return new Promise((resolve, reject) => {
      execFile('/usr/bin/reportgen', ['--role', sanitizedRole], (error, stdout, stderr) => {
        if (error) {
          reject(error);
        } else {
          context.params.report = stdout.toString();
          resolve(context);
        }
      });
    });
  }
});

Example 3: Middleware hook to sanitize data before any external invocation

const sanitize = require('sanitize-filename');

app.hooks({
  before: {
    all: [context => {
      if (context.params.user && context.params.user.meta) {
        // Ensure no shell-special characters in user-provided metadata
        if (context.params.user.meta.filename) {
          context.params.user.meta.safeFilename = sanitize(context.params.user.meta.filename);
        }
      }
      return context;
    }]
  }
});

These examples emphasize strict input validation, avoiding shell interpretation by using argument arrays, and never embedding JWT claims into shell commands. middleBrick’s checks for input validation and unsafe consumption help identify endpoints where JWT data might reach risky execution paths.