Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs_module_read in the njs_module.c file.
cpe:2.3:a:nginx:njs:2019-06-27:*:*:*:*:*:*:*
76C92D85-F51F-4CD4-8DC4-BD4428A3C0E1
OR
# env
ubuntu 18.04
njs 0feca92
gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)

# bug
So, actually this is a logic bug, happened under an really interesting circumstance.
the buggy function is the njs_module_read in the file njs_module.c
```c
if (fstat(fd, &sb) == -1) {
        goto fail;
    }

    text->length = nxt_length(NJS_MODULE_START);

    if (S_ISREG(sb.st_mode) && sb.st_size) {
        text->length += sb.st_size;
    }

    text->length += nxt_length(NJS_MODULE_END);

    text->start = nxt_mp_alloc(vm->mem_pool, text->length);
    if (text->start == NULL) {
        goto fail;
    }

    p = nxt_cpymem(text->start, NJS_MODULE_START, nxt_length(NJS_MODULE_START));

    n = read(fd, p, sb.st_size);
```
as you can see, it read the sb.st_size and sb.st_mode with function fstat. However if we dont provide a common .js file. the S_ISREG(sb.st_mode) will be 0. text->length wont be updated.
and read(fd, p, sb.st_size); still read sb.st_size bytes into the p. p is on the heap. So we can overflow to the next chunk on the heap....

# poc
```
import crypto from '/'
```
Heap based buffer overflow in njs_module.c
This is a GitHub Issue
repo:njs
owner:nginx
Title : Heap based buffer overflow in njs_module.c
Issue date:

--- start body ---
# env
ubuntu 18.04
njs 0feca92
gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)

# bug
So, actually this is a logic bug, happened under an really interesting circumstance.
the buggy function is the njs_module_read in the file njs_module.c
```c
if (fstat(fd, &sb) == -1) {
        goto fail;
    }

    text->length = nxt_length(NJS_MODULE_START);

    if (S_ISREG(sb.st_mode) && sb.st_size) {
        text->length += sb.st_size;
    }

    text->length += nxt_length(NJS_MODULE_END);

    text->start = nxt_mp_alloc(vm->mem_pool, text->length);
    if (text->start == NULL) {
        goto fail;
    }

    p = nxt_cpymem(text->start, NJS_MODULE_START, nxt_length(NJS_MODULE_START));

    n = read(fd, p, sb.st_size);
```
as you can see, it read the sb.st_size and sb.st_mode with function fstat. However if we dont provide a common .js file. the S_ISREG(sb.st_mode) will be 0. text->length wont be updated.
and read(fd, p, sb.st_size); still read sb.st_size bytes into the p. p is on the heap. So we can overflow to the next chunk on the heap....

# poc
```
import crypto from '/'
```
--- end body ---

comments :
--- start comments ---

--- end comments ---