Executive brief
The aws-lambda npm package is a command-line deployment tool used to upload code to AWS Lambda functions. A vulnerability allows arbitrary command injection through the function name parameter, enabling attackers to execute malicious commands on systems using this tool. This could lead to unauthorized code execution and compromise of deployment infrastructure.
Technical details
The vulnerability is an OS command injection (CWE-78) in versions prior to 1.0.5. The config.FunctionName parameter is used directly in constructing arguments for the exec() function without sanitization, allowing attackers to inject arbitrary shell commands into the zipCmd execution. The attack requires that a user runs the tool with a maliciously-crafted function name; no authentication or special privileges are required. A successful exploit allows arbitrary command execution in the context of the user running the deployment tool. The fix is available in version 1.0.5 and later.
Affected products
- awspilot aws-lambda <1.0.5
Timeline
- 2020-02-14: disclosed
- 2020-02-14: patched: Version 1.0.5 released with fix