Executive brief
hubot-scripts is a popular chatbot script library used to extend Hubot's functionality. A command injection vulnerability in the email script allows an attacker to execute arbitrary commands on the system running Hubot, potentially compromising the server and gaining full system access. Although the vulnerable email script is not enabled by default, manual activation exposes organizations to severe risks.
Technical details
The vulnerability is a command injection flaw (CWE-74) in the email.coffee module of hubot-scripts versions 2.4.3 and earlier. The vulnerable component fails to properly sanitize user-supplied input before passing it to shell command execution, allowing an attacker to inject arbitrary commands. The attack requires network access to the Hubot instance and no authentication is needed if the email script is enabled; the flaw is triggered through user input to the email command. An attacker can achieve arbitrary code execution with the privileges of the Hubot process. The fix is available in version 2.4.4 and later (some sources indicate 2.4.5).
Affected products
- hubot-scripts hubot-scripts 2.4.3 and earlier
Timeline
- 2020-08-31: disclosed