Executive brief
The macaddress npm package provides utilities to retrieve MAC addresses on a system. A command injection vulnerability in all versions prior to 0.2.9 allows attackers who can control the interface name argument to execute arbitrary system commands with the privileges of the Node.js process, potentially compromising the server or application.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the macaddress library's `one()` method, which fails to properly sanitize the `iface` parameter before passing it to shell execution functions. The vulnerable code uses `exec()` to construct and execute shell commands with unsanitized user input. An attacker who can control the interface name argument can inject arbitrary shell metacharacters to execute additional commands. The fix, released in version 0.2.9, replaces `exec()` with `execFile()`, which executes commands without invoking a shell interpreter, preventing command injection. No authentication or user interaction is required; the attacker only needs to control the `iface` argument.
Affected products
- npm macaddress all versions before 0.2.9
Timeline
- 2018-09-06: disclosed
- 2018-06-23: patched: Fix merged in PR #20