Executive brief
codem-transcode is a Node.js library for video transcoding that can optionally enable ffprobe, a tool for analyzing media files. When ffprobe is enabled, an attacker can send a malformed filename through an HTTP endpoint to execute arbitrary commands on the server, potentially compromising the system and exposing sensitive data.
Technical details
This is a command injection vulnerability (CWE-77) in the /probe HTTP endpoint of codem-transcode. When ffprobe functionality is enabled, user-supplied filenames are passed unsanitized to the ffprobe binary, allowing an attacker to inject shell metacharacters and execute arbitrary commands. The attack vector is network-based but requires that ffprobe be explicitly enabled and, by default, the server must be made publicly accessible (it binds to localhost by default). An attacker can achieve complete code execution with the privileges of the server process. A patched version (0.5.0) was released on npm.
Affected products
- codem-transcode codem-transcode before 0.5.0
Timeline
- 2017-11-28: disclosed