feat(skills): add NestJS security testing module (#348)
This commit is contained in:
Ms6RB
225
strix/skills/frameworks/nestjs.md
Normal file
225
strix/skills/frameworks/nestjs.md
Normal file
@@ -0,0 +1,225 @@
|
||||
---
|
||||
name: nestjs
|
||||
description: Security testing playbook for NestJS applications covering guards, pipes, decorators, module boundaries, and multi-transport auth
|
||||
---
|
||||
|
||||
# NestJS
|
||||
|
||||
Security testing for NestJS applications. Focus on guard gaps across decorator stacks, validation pipe bypasses, module boundary leaks, and inconsistent auth enforcement across HTTP, WebSocket, and microservice transports.
|
||||
|
||||
## Attack Surface
|
||||
|
||||
**Decorator Pipeline**
|
||||
- Guards: `@UseGuards`, `CanActivate`, execution context (HTTP/WS/RPC), `Reflector` metadata
|
||||
- Pipes: `ValidationPipe` (whitelist, transform, forbidNonWhitelisted), `ParseIntPipe`, custom pipes
|
||||
- Interceptors: response mapping, caching, logging, timeout — can modify request/response flow
|
||||
- Filters: exception filters that may leak information
|
||||
- Metadata: `@SetMetadata`, `@Public()`, `@Roles()`, `@Permissions()`
|
||||
|
||||
**Module System**
|
||||
- `@Module` boundaries, provider scoping (DEFAULT/REQUEST/TRANSIENT)
|
||||
- Dynamic modules: `forRoot`/`forRootAsync`, global modules
|
||||
- DI container: provider overrides, custom providers
|
||||
|
||||
**Controllers & Transports**
|
||||
- REST: `@Controller`, versioning (URI/Header/MediaType)
|
||||
- GraphQL: `@Resolver`, playground/sandbox exposure
|
||||
- WebSocket: `@WebSocketGateway`, gateway guards, room authorization
|
||||
- Microservices: TCP, Redis, NATS, MQTT, gRPC, Kafka — often lack HTTP-level auth
|
||||
|
||||
**Data Layer**
|
||||
- TypeORM: repositories, QueryBuilder, raw queries, relations
|
||||
- Prisma: `$queryRaw`, `$queryRawUnsafe`
|
||||
- Mongoose: operator injection, `$where`, `$regex`
|
||||
|
||||
**Auth & Config**
|
||||
- `@nestjs/passport` strategies, `@nestjs/jwt`, session-based auth
|
||||
- `@nestjs/config`, ConfigService, `.env` files
|
||||
- `@nestjs/throttler`, rate limiting with `@SkipThrottle`
|
||||
|
||||
**API Documentation**
|
||||
- `@nestjs/swagger`: OpenAPI exposure, DTO schemas, auth schemes
|
||||
|
||||
## High-Value Targets
|
||||
|
||||
- Swagger/OpenAPI endpoints in production (`/api`, `/api-docs`, `/api-json`, `/swagger`)
|
||||
- Auth endpoints: login, register, token refresh, password reset, OAuth callbacks
|
||||
- Admin controllers decorated with `@Roles('admin')` — test with user-level tokens
|
||||
- File upload endpoints using `FileInterceptor`/`FilesInterceptor`
|
||||
- WebSocket gateways sharing business logic with HTTP controllers
|
||||
- Microservice handlers (`@MessagePattern`, `@EventPattern`) — often unguarded
|
||||
- CRUD generators (`@nestjsx/crud`) with auto-generated endpoints
|
||||
- Background jobs and scheduled tasks (`@nestjs/schedule`)
|
||||
- Health/metrics endpoints (`@nestjs/terminus`, `/health`, `/metrics`)
|
||||
- GraphQL playground/sandbox in production (`/graphql`)
|
||||
|
||||
## Reconnaissance
|
||||
|
||||
**Swagger Discovery**
|
||||
```
|
||||
GET /api
|
||||
GET /api-docs
|
||||
GET /api-json
|
||||
GET /swagger
|
||||
GET /docs
|
||||
GET /v1/api-docs
|
||||
GET /api/v2/docs
|
||||
```
|
||||
|
||||
Extract: paths, parameter schemas, DTOs, auth schemes, example values. Swagger may reveal internal endpoints, deprecated routes, and admin-only paths not visible in the UI.
|
||||
|
||||
**Guard Mapping**
|
||||
|
||||
For each controller and method, identify:
|
||||
- Global guards (applied in `main.ts` or app module)
|
||||
- Controller-level guards (`@UseGuards` on the class)
|
||||
- Method-level guards (`@UseGuards` on individual handlers)
|
||||
- `@Public()` or `@SkipThrottle()` decorators that bypass protection
|
||||
|
||||
## Key Vulnerabilities
|
||||
|
||||
### Guard Bypass
|
||||
|
||||
**Decorator Stack Gaps**
|
||||
- Guards execute: global → controller → method. A method missing `@UseGuards` when siblings have it is the #1 finding.
|
||||
- `@Public()` metadata causing global `AuthGuard` to skip enforcement — check if applied too broadly.
|
||||
- New methods added to existing controllers without inheriting the expected guard.
|
||||
|
||||
**ExecutionContext Switching**
|
||||
- Guards handling only HTTP context (`getRequest()`) may fail silently on WebSocket or RPC, returning `true` by default.
|
||||
- Test same business logic through alternate transports to find context-specific bypasses.
|
||||
|
||||
**Reflector Mismatches**
|
||||
- Guard reads `SetMetadata('roles', [...])` but decorator sets `'role'` (singular) — guard sees no metadata, defaults to allow.
|
||||
- `applyDecorators()` compositions accidentally overriding stricter guards with permissive ones.
|
||||
|
||||
### Validation Pipe Exploits
|
||||
|
||||
**Whitelist Bypass**
|
||||
- `whitelist: true` without `forbidNonWhitelisted: true`: extra properties silently stripped but may have been processed by earlier middleware/interceptors.
|
||||
- Missing `@Type(() => ChildDto)` on nested objects: `@ValidateNested()` without `@Type` means nested payload is never validated.
|
||||
- Array elements: `@IsArray()` doesn't validate elements without `@ValidateNested({ each: true })` and `@Type`.
|
||||
|
||||
**Type Coercion**
|
||||
- `transform: true` enables implicit coercion: strings → numbers, `"true"` → `true`, `"null"` → `null`.
|
||||
- Exploit truthiness assumptions in business logic downstream.
|
||||
|
||||
**Conditional Validation**
|
||||
- `@ValidateIf()` and validation groups creating paths where fields skip validation entirely.
|
||||
|
||||
**Missing Parse Pipes**
|
||||
- `@Param('id')` without `ParseIntPipe`/`ParseUUIDPipe` — string values reach ORM queries directly.
|
||||
|
||||
### Auth & Passport
|
||||
|
||||
**JWT Strategy**
|
||||
- Check `ignoreExpiration` is false, `algorithms` is pinned (no `none` or HS/RS confusion)
|
||||
- Weak `secretOrKey` values
|
||||
- Cross-service token reuse when audience/issuer not enforced
|
||||
|
||||
**Passport Strategy Issues**
|
||||
- `validate()` return value becomes `req.user` — if it returns full DB record, sensitive fields leak downstream
|
||||
- Multiple strategies (JWT + session): one may bypass restrictions of the other
|
||||
- Custom guards returning `true` for unauthenticated as "optional auth"
|
||||
|
||||
**Timing Attacks**
|
||||
- Plain string comparison instead of bcrypt/argon2 in local strategy
|
||||
|
||||
### Serialization Leaks
|
||||
|
||||
**Missing ClassSerializerInterceptor**
|
||||
- If not applied globally, `@Exclude()` fields (passwords, internal IDs) returned in responses.
|
||||
- `@Expose()` with groups: admin-only fields exposed when groups not enforced per-request.
|
||||
|
||||
**Circular Relations**
|
||||
- Eager-loaded TypeORM/Prisma relations exposing entire object graph without careful serialization.
|
||||
|
||||
### Interceptor Abuse
|
||||
|
||||
**Cache Poisoning**
|
||||
- `CacheInterceptor` without user/tenant identity in cache key — responses from one user served to another.
|
||||
- Test: authenticated request, then unauthenticated request returning cached data.
|
||||
|
||||
**Response Mapping**
|
||||
- Transformation interceptors may leak internal entity fields if mapping is incomplete.
|
||||
|
||||
### Module Boundary Leaks
|
||||
|
||||
**Global Module Exposure**
|
||||
- `@Global()` modules expose all providers to every module without explicit imports.
|
||||
- Sensitive services (admin operations, internal APIs) accessible from untrusted modules.
|
||||
|
||||
**Config Leaks**
|
||||
- `forRoot`/`forRootAsync` configuration secrets accessible via `ConfigService` injection in any module.
|
||||
|
||||
**Scope Issues**
|
||||
- Request-scoped providers (`Scope.REQUEST`) incorrectly scoped as DEFAULT (singleton) — request context leaks across concurrent requests.
|
||||
|
||||
### WebSocket Gateway
|
||||
|
||||
- HTTP guards don't automatically apply to WebSocket gateways — `@UseGuards` must be explicit.
|
||||
- Authentication deferred from `handleConnection` to message handlers allows unauthenticated message sending.
|
||||
- Room/namespace authorization: users joining rooms they shouldn't access.
|
||||
- `@SubscribeMessage()` handlers relying on connection-level auth instead of per-message validation.
|
||||
|
||||
### Microservice Transport
|
||||
|
||||
- `@MessagePattern`/`@EventPattern` handlers often lack guards (considered "internal").
|
||||
- If transport (Redis, NATS, Kafka) is network-accessible, messages can be injected bypassing all HTTP security.
|
||||
- `ValidationPipe` may only be configured for HTTP — microservice payloads skip validation.
|
||||
|
||||
### ORM Injection
|
||||
|
||||
**TypeORM**
|
||||
- `QueryBuilder` and `.query()` with template literal interpolation → SQL injection.
|
||||
- Relations: API allowing specification of which relations to load via query params.
|
||||
|
||||
**Mongoose**
|
||||
- Query operator injection: `{ password: { $gt: "" } }` via unsanitized request body.
|
||||
- `$where` and `$regex` operators from user input.
|
||||
|
||||
**Prisma**
|
||||
- `$queryRaw`/`$executeRaw` with string interpolation (but not tagged template).
|
||||
- `$queryRawUnsafe` usage.
|
||||
|
||||
### Rate Limiting
|
||||
|
||||
- `@SkipThrottle()` on sensitive endpoints (login, password reset, OTP).
|
||||
- In-memory throttler storage: resets on restart, doesn't work across instances.
|
||||
- Behind proxy without `trust proxy`: all requests share same IP, or header spoofable.
|
||||
|
||||
### CRUD Generators
|
||||
|
||||
- Auto-generated CRUD endpoints may not inherit manual guard configurations.
|
||||
- Bulk operations (`createMany`, `updateMany`) bypassing per-entity authorization.
|
||||
- Query parameter injection in CRUD libraries: `filter`, `sort`, `join`, `select` exposing unauthorized data.
|
||||
|
||||
## Bypass Techniques
|
||||
|
||||
- `@Public()` / skip-metadata applied via composed decorators at method level causing global guards to skip via `Reflector` metadata checks
|
||||
- Route param pollution: `/users/123?id=456` — which `id` wins in guards vs handlers?
|
||||
- Version routing: v1 of endpoint may still be registered without the guard added to v2
|
||||
- `X-HTTP-Method-Override` or `_method` processed by Express before guards
|
||||
- Content-type switching: `application/x-www-form-urlencoded` instead of JSON to bypass JSON-specific validation
|
||||
- Exception filter differences: guard throwing results in generic error that leaks route existence info
|
||||
|
||||
## Testing Methodology
|
||||
|
||||
1. **Enumerate** — Fetch Swagger/OpenAPI, map all controllers, resolvers, and gateways
|
||||
2. **Guard audit** — Map decorator stack per method: which guards, pipes, interceptors are applied at each level
|
||||
3. **Matrix testing** — Test each endpoint across: unauth/user/admin × HTTP/WS/microservice
|
||||
4. **Validation probing** — Send extra fields, wrong types, nested objects, arrays to find pipe gaps
|
||||
5. **Transport parity** — Same operation via HTTP, WebSocket, and microservice transport
|
||||
6. **Module boundaries** — Check if providers from one module are accessible without proper imports
|
||||
7. **Serialization check** — Compare raw entity fields with API response fields
|
||||
|
||||
## Validation Requirements
|
||||
|
||||
- Guard bypass: request to guarded endpoint succeeding without auth, showing guard chain break point
|
||||
- Validation bypass: payload with extra/malformed fields affecting business logic
|
||||
- Cross-transport inconsistency: same action authorized via HTTP but exploitable via WebSocket/microservice
|
||||
- Module boundary leak: accessing provider or data across unauthorized module boundaries
|
||||
- Serialization leak: response containing excluded fields (passwords, internal metadata)
|
||||
- IDOR: side-by-side requests from different users showing unauthorized data access
|
||||
- ORM injection: raw query with user-controlled input returning unauthorized data, or error-based evidence of query structure
|
||||
- Cache poisoning: response from unauthenticated or different-user request matching a prior authenticated user's cached response
|
||||
Reference in New Issue
Block a user