Executive brief
libnmap is a Node.js library used to programmatically run and parse Nmap network scans. A command injection vulnerability in versions before 0.4.16 allows an attacker to execute arbitrary shell commands by crafting malicious scan parameters, potentially compromising the host system running the scan.
Technical details
The vulnerability is a classic command injection (CWE-77) in the libnmap library where user-supplied input in scan options (e.g., range parameters) is insufficiently sanitized before being passed to shell execution. An attacker can inject shell metacharacters and commands into scan parameters—such as the range field shown in the proof-of-concept using `$(touch success.txt)`—to execute arbitrary code on the host running the scan. The attack requires the application to call the vulnerable nmap.scan() function with attacker-controlled input. This was fixed in version 0.4.16.
Affected products
- libnmap libnmap before 0.4.16
Timeline
- 2018-11-01: disclosed
- 2018-11-01: patched: Fix released in version 0.4.16