Executive brief
The npm whereis library is used to locate executable programs on a system. When untrusted user input is passed to the library without proper sanitization, an attacker can inject arbitrary shell commands that will be executed with the privileges of the application using whereis, leading to complete system compromise.
Technical details
The whereis npm library prior to version 0.4.1 is vulnerable to command injection (CWE-77) due to improper escaping of user-supplied input when constructing shell commands. The vulnerability occurs when untrusted input is passed to the whereis function without sanitization before being executed in a shell context. An attacker can inject arbitrary shell metacharacters and commands that will be executed with the privileges of the process running the vulnerable code. No authentication or user interaction is required; the attack is exploitable over the network if the application passes user input to whereis. The fix in version 0.4.1 implements proper argument escaping to prevent command injection.
Affected products
- npm whereis before 0.4.1
Timeline
- 2018-07-31: disclosed
- 2018: patched: Version 0.4.1 released with security fix