Junglewise Threat Intelligence

CVE-2018-3786: egg-scripts command injection

CVE-2018-3786 · Severity: low · CVSS 3.1 · Published 2018-09-17

Vendors: npm.

Executive brief

egg-scripts is a command-line tool used to manage Egg.js application lifecycle (starting, stopping, restarting servers). A command injection vulnerability allows attackers who can control command-line arguments to execute arbitrary system commands, potentially leading to complete compromise of the server running the application.

Technical details

The vulnerability is a command injection flaw (CWE-77, CWE-78) in egg-scripts versions before 2.8.1, caused by the use of the shell exec() function to process command-line arguments without proper sanitization. An attacker can inject shell metacharacters (such as semicolons or pipes) into arguments like --stderr to execute arbitrary commands. The vulnerability requires direct control over command-line arguments passed to eggctl. The fix involves replacing the unsafe exec() call with execFile(), which avoids shell interpretation of arguments. The patch was released in version 2.8.1.

Affected products

  • Egg.js egg-scripts before 2.8.1

Timeline

  • 2018-09-17: disclosed
  • 2018-08-19: patched: Fix released in version 2.8.1

References