Executive brief
console-io is a Node.js package that provides terminal access to server systems through a web interface. An authentication bypass vulnerability in the underlying websocket library allows unauthenticated remote attackers to gain terminal access and execute arbitrary commands on the server, equivalent to remote code execution.
Technical details
The vulnerability is an improper authentication issue (CWE-287) where the console-io package fails to properly configure its underlying websocket library to enforce authentication requirements. The websocket endpoint that provides terminal access to the server is left unauthenticated and publicly accessible to any network-based attacker. Because console-io allows full terminal/shell access via this web interface, successful exploitation grants unauthenticated remote code execution with the privileges of the application process. The vulnerability affects all versions prior to 2.3.0; the fix is available in version 2.3.0 and later.
Affected products
- npm console-io < 2.3.0
Timeline
- 2019-02-18: disclosed
- 2.3.0: patched: Fix released in version 2.3.0