Description

Qwik provides an extended serialization mechanism for exchanging data between the client and server. This allows for the serialization and deserialization of Date, Regex, Signal, Function and many other useful data types.

The Function deserializer can be accessed using the pureServerFunction feature. This allows us to pass in any Javascript code to be run by node.js.

Proof of Concept

By sending a POST request with a content type of application/qwik-json to /q-data.json we can trigger the vulnerable deserialization.

You can see the full proof of concept here. There is a little bit of finesse required due to the execution environment.

Video here.

Impact

Full compromise of CIA on most deployments.

Will not work on Cloudflare workers, or static deployments.