Executive brief
egg-scripts is a command-line tool used to manage Egg.js application lifecycle (starting, stopping, restarting servers). A command injection vulnerability allows attackers who can control command-line arguments to execute arbitrary system commands, potentially leading to complete compromise of the server running the application.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in egg-scripts versions before 2.8.1, caused by the use of the shell exec() function to process command-line arguments without proper sanitization. An attacker can inject shell metacharacters (such as semicolons or pipes) into arguments like --stderr to execute arbitrary commands. The vulnerability requires direct control over command-line arguments passed to eggctl. The fix involves replacing the unsafe exec() call with execFile(), which avoids shell interpretation of arguments. The patch was released in version 2.8.1.
Affected products
- Egg.js egg-scripts before 2.8.1
Timeline
- 2018-09-17: disclosed
- 2018-08-19: patched: Fix released in version 2.8.1