{"uuid": "08036fbc-05a4-4cd4-93b6-0bf332fec2f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44228", "type": "seen", "source": "https://t.me/hacking_Attack/53457", "content": "KitPloit - PenTest Tools!\nNodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgofQEgI4u-jUWx7H-ii-ce51t0I-ACbfpzxkI99qosLwK_aTtNOTWEj2fYNW-kqczhOwYkmsElkG-icMNC6pJRLUP0a8W5JP6iyjSfugXpfRZ3-0u-wdi0_CbL0nRYgHBlIaX_AdSvBOV8yP1g8__HeqoWa0jw7cAKXXqVgc42zZXSv9z5aQcX6zIT/s320/NodeSecurityShield_1_NodeSecurityShield.png A Developer and Security Engineer friendly package for Securing NodeJS Applications.\n\nInspired by the log4J vulnerability (CVE-2021-44228) which can be exploited because an application can make arbitrary network calls.\n\nWe felt there is an need for an application to declare what privileges it can have so that exploitation of such vulnerabilities becomes harder.\n\nTo achieve this, NSS (Node Security Shield) has Resource Access Policy. Resource Access Policy (RAP)Resource Access Policy is similar to CSP(Content Security Policy).\n\nIt lets the developer/security engineer declare what resources an application should access. And Node Security Shield will enforce it. InstallationInstall Node Security Shield using npm npm install nodesecurityshieldUsage// Require Node Security Shield\nlet nodeSecurityShield = require('nodesecurityshield');\n\n// Enable Attack Monitoring and/or Blocking\nnodeSecurityShield.enableAttackMonitoring(resourceAccessPolicy ,callbackFunction);Sample resourceAccessPolicy const resourceAccessPolicy  = {\n\"outBoundRequest\" : {\n\"blockedDomains\" : [\"*.123.com\", \"stats.abc.com\", 'xyz.com'],\n\"allowedDomains\" : [\"*.domdog.io\"]\n}\n};* Note: blockedDomains holds precedence over allowedDomains.\n* i.e., requests checked against blockedDomains first then allowedDomains.\n\nSample callbackFunction for Attack Monitoring var callbackFunction = function (violationEvent) {\nconsole.log(violationEvent);\n}Sample callbackFunction for Attack Blocking var callbackFunction = function (violationEvent) {\nthrow new Error(\"Request Blocked. It violates declared Resource Access Policy.\")\n}Sample violationEvent {\n\"violationtType\": \"Outbound Request\",\n\"message\": \"Outbound request to 'www.malicious.com' violates declared 'Resource Access Policy (RAP)'.\",\n\"policy\": {\n\"outBoundRequest\" : {\n\"blockedDomains\" : [\"*.123.com\", \"stats.abc.com\", 'xyz.com'],\n\"allowedDomains\" : [\"*.domdog.io\"]\n}\n}Integrating with SentrySample callbackFunction to integrate with Sentry var callbackFunction = function (violationEvent) {\n\nvar e = new Error();\ne.name = 'Resource Access Policy Violation';\ne.message = JSON.stringify(violationEvent);\nSentry.captureException(e);\n\n}Screenshot from Sentry dashboard https://blogger.googleusercontent.com/img/a/AVvXsEi4IGbW8O-xScePg6pGyBGXBQ7FSFzOqBuoDaW3610t9f6LrEk3j8Sqw82oHePkczzIZdQkpr_k1itqPyuitzOyvPB0PiLdk6o0Um3rVvZ36t73wh74HpePpstHki9r1k14nY9G4beH1i4mTJjFVs3sWoJPZ7HA29E-3EpVZ13kxr6G1vpnjelC0V2r=w640-h96 Features* Attack Monitoring \n* Outbound Network Calls\n\n* Attack Blocking \n* Outbound Network Calls Roadmap* Attack Monitoring \n* Command Execution\n* File Calls\n\n* Attack Blocking \n* Command Execution\n* File Calls\n\n* Vulnerability Scanner Authors* Lavakumar Kuppan \n* Github    - @lavakumar\n* Twitter   - @lavakumark\n\n* Sukesh Pappu \n* Github    - @thelogicalbeard\n* Twitter   - @thelogicalbeard LicenseApache License 2.0 Download NodeSecurityShield\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:39.926946Z"}