Executive brief
dns-sync is a Node.js library for performing DNS lookups. The resolve() method contains a command injection vulnerability that allows attackers to execute arbitrary system commands by passing specially crafted input to the DNS resolution function. An attacker who can control the input to resolve() can gain complete system access with the privileges of the application running dns-sync.
Technical details
The vulnerability is a command injection flaw (CWE-94) in the resolve() method of dns-sync. The vulnerable code constructs a shell command by concatenating user input (hostname parameter) into a command string without proper escaping or sanitization, then executes it via shell.exec(). An attacker can inject shell metacharacters (e.g., $(id)) into the hostname parameter to break out of the intended command and execute arbitrary commands. Attack vector is local/network depending on application context; no authentication is required if the resolve() method is exposed to untrusted input. Versions prior to 0.1.1 are affected. A fix is available in version 0.1.1 and later.
Affected products
- dns-sync All versions before 0.1.1
Timeline
- 2014-11-10: disclosed
- 2018-07-18: advisory