Executive brief
addax is a Node.js package used for managing presigned paths in cloud storage operations. Versions before 1.1.0 fail to validate user input in the presignPath API endpoint, allowing authenticated attackers to inject and execute arbitrary system commands on the server. This could lead to full system compromise including data theft, service disruption, or malware installation.
Technical details
The vulnerability is a command injection (CWE-77) in the presignPath function that accepts user-supplied input directly from API endpoints without validation or sanitization. The attack vector is network-based and requires prior authentication to reach the vulnerable endpoint. An authenticated attacker can craft malicious input containing shell metacharacters or command separators to break out of the intended command context and execute arbitrary commands with the privileges of the Node.js process. The fix is available in version 1.1.0 and later.
Affected products
- npm addax <1.1.0
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Fix available in version 1.1.0