Total control possible since turn checking is clientside only

[hypevhs]

It's possible to set the value of hasTurn from the Chrome developer window to consistently be able to send mouse and keyboard commands to the computer, regardless of whether it's my turn or not.

This is because the server does not check whether the messages received were really from the current user.

[yoshiandmario1]

You can also send QEMU commands using a line less that's less then 17 characters. This can be very abusive, especially if one constantly sends a reset command to the system... I found this from looking at the code for 5 minutes. Cool application, but get some security on this.

[hypevhs]

As an example, when the client sends

io.emit("keydown", "\nreset_system");

the VM will reset. I think the QEMU keycode conversion should be done on
the server, or at least scrubbed to contain only valid sendkey stuff.
@yoshiandmario1 's and this issue are different vulnerabilities, but
they're closely related in that the clients are making more decisions than
they should.

On Wed, Mar 25, 2015 at 2:30 AM, yoshiandmario1 notifications@github.com
wrote:

You can also send QEMU commands using a line less that's less then 17
characters. This can be very abusive, especially if one constantly sends a
reset command to the system... I found this from looking at the code for 5
minutes. Cool application, but get some security on this.

—
Reply to this email directly or view it on GitHub
#8 (comment)
.

[fb39ca4]

Not to mention there are QEMU monitor commands to dump a portion of the VM's memory to a file. You can write an arbitrary file to the server this way if you load its contents to a known memory location in the guest operating system.

[parves272]

IDM350 added a commit to IDM350/socket.io-computer that referenced this issue on Aug 5, 2015
Control mouse and keyboard access on server side (#8)

Not working with last updated files > delegated.js | emu.js | io.js | turn.js

node io.js
(getting error)

/var/www/html/socket.io-computer/delegated.js:27
module.exports = delegatedListeners;
^^^^^^
SyntaxError: Unexpected identifier
at Module._compile (module.js:439:25)
at Object.Module._extensions..js (module.js:474:10)
at Module.load (module.js:356:32)
at Function.Module._load (module.js:312:12)
at Module.require (module.js:364:17)
at require (module.js:380:17)
at Object. (/var/www/html/socket.io-computer/io.js:19:26)
at Module._compile (module.js:456:26)
at Object.Module._extensions..js (module.js:474:10)
at Module.load (module.js:356:32)

can you help me out to works? and how?