Executive brief
gm is a Node.js library for image manipulation that wraps the GraphicsMagick tool. The library fails to properly sanitize user input when comparing images, allowing attackers to execute arbitrary shell commands on systems running vulnerable versions of the library. This could lead to complete system compromise if the application processes untrusted image data.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the gm.compare() function, which does not properly escape arguments before passing them to the underlying GraphicsMagick binary. An attacker can inject shell metacharacters through image file paths or other parameters to execute arbitrary operating system commands. The attack requires the attacker to control input passed to the compare() function, and no prior authentication is necessary if the application exposes this functionality to unauthenticated users. An exploit allows full remote code execution with the privileges of the process running gm. The vulnerability was patched in version 1.21.1 with proper argument escaping.
Affected products
- gm gm before 1.21.1
Timeline
- 2015-10-26: disclosed: Security fix released in version 1.21.0
- 2020-09-01: advisory: Advisory published as GHSA-pjh3-jv7w-9jpr