Executive brief
Node-Traceroute is a Node.js library that performs network traceroute operations. A remote code injection vulnerability allows attackers to execute arbitrary OS commands by injecting commands after a newline character in the host parameter, potentially leading to full system compromise.
Technical details
The vulnerability is a command injection flaw (CWE-74) in the traceroute package (versions through 1.0.0) that arises from unsafe use of Child.exec() to execute system commands. The vulnerable code fails to properly sanitize the host parameter, allowing an attacker to inject arbitrary OS commands after a newline character. The attack is network-accessible and requires no authentication or user interaction. A remote attacker can execute arbitrary commands with the privileges of the Node.js process. The vulnerability was patched by replacing Child.exec() with the safer spawn() method and implementing proper input handling, as shown in commit b99ee024.
Affected products
- npm traceroute through 1.0.0
Timeline
- 2020-06-25: disclosed: CVE-2018-21268 published on NVD
- 2020: patched: Fix applied via commit b99ee024 converting Child.exec() to spawn()