Executive brief
apex-publish-static-files is a Node.js library used to publish static files to cloud storage. Versions before 2.0.1 allow attackers to inject arbitrary shell commands if user-controlled input is passed to the connectString option, potentially leading to full system compromise or data theft.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the connectString parameter of the publish method. When user input is unsanitized and passed directly to a shell execution context, an attacker can break out of the intended parameter and execute arbitrary OS commands. The attack requires that an application using the library accepts external input and passes it to the connectString option without validation. This is a network-accessible vulnerability with no authentication or user interaction required if the vulnerable code is exposed via a web service or API. Versions 2.0.1 and later patch this issue by properly sanitizing or validating the connectString parameter.
Affected products
- apex-publish-static-files apex-publish-static-files before 2.0.1
Timeline
- 2018-11-01: disclosed: Advisory published
- 2018: patched: Fixed in version 2.0.1