Executive brief
bestzip is a Node.js package used to create ZIP archives from files and directories. Versions before 2.1.7 fail to sanitize user input when constructing system commands, allowing attackers to inject arbitrary shell commands that execute with the privileges of the application. An attacker who controls the destination parameter can execute arbitrary code on the system where bestzip is running.
Technical details
This is a command injection vulnerability (CWE-77) in the bestzip npm package. The vulnerability exists in versions prior to 2.1.7, where user-supplied input to the destination parameter is passed directly to an exec() call without sanitization. An attacker can inject shell metacharacters and commands into the destination argument, which are then executed by the underlying zip command on systems where a native zip binary is available. The attack requires that the destination parameter value be under attacker control—either through CLI arguments or programmatic API calls. Exploitation results in arbitrary command execution with the privileges of the process running bestzip. The vulnerability was patched in version 2.1.7.
Affected products
- npm bestzip < 2.1.7
Timeline
- 2020-09-02: disclosed