Executive brief
The printer package is a Node.js library used to interact with system printers. A flaw in the package's printDirect() function fails to properly sanitize user input before passing it to system commands. This allows an attacker to inject arbitrary operating system commands and execute code with the privileges of the application running the printer package, potentially compromising the entire system.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the printDirect() function of the printer npm package (versions ≤ 0.0.1). The root cause is the failure to sanitize command arguments before passing them to system shell execution. An attacker with network access to an application using vulnerable versions of the printer package can inject malicious shell metacharacters through printer parameters to execute arbitrary commands on the host system. No authentication or user interaction is required; the attack surface is the printDirect() API itself. The fix, committed in version 0.0.2, removes the unquoted command injection vector. Patch is available and users should update to version 0.0.2 or later immediately.
Affected products
- tojocky printer <= 0.0.1
Timeline
- 2014-05-13: disclosed: Vulnerability reported to oss-security mailing list
- 2014-05-14: other: CVE-2014-3741 assigned
- 2014: patched: Fix committed; version 0.0.2 released with patch
- 2017-11-28: advisory: GHSA-5c8j-xr24-2665 published