Executive brief
sync-exec is a Node.js library used to run system commands. A security flaw in how it handles temporary data allows other users on the same server to read the output of those commands. This could lead to the exposure of sensitive information, such as system configurations or credentials, if they are part of the command results.
Technical details
The sync-exec module (versions 0.6.2 and earlier) implements a synchronous command execution wrapper for Node.js by buffering command output to files in the /tmp directory. Because these files are created with insecure permissions in a world-readable directory, any user with local access to the system can read the contents of the buffer while it exists. This constitutes an insecure temporary file vulnerability (CWE-377). While the CVSS vector indicates a network attack vector, the primary exploit scenario involves local privilege escalation or information disclosure on multi-user systems. No patch is available for the library; users are advised to migrate to the native child_process.execSync function available in Node.js v0.12.0 and later.
Affected products
- gvarsanyi sync-exec <= 0.6.2
Timeline
- 2016-01-24: disclosed: Issue first reported on GitHub
- 2018-06-04: advisory: NVD published CVE-2017-16024
- 2018-11-09: advisory: GitHub Advisory published