Executive brief
devcert-sanscache is a development utility that generates self-signed SSL/TLS certificates for local testing. A critical vulnerability allows attackers to inject and execute arbitrary system commands by manipulating certificate names. An attacker can gain complete control over systems running affected versions, potentially compromising development environments and enabling lateral movement within corporate networks.
Technical details
This is an OS command injection vulnerability (CWE-78) in devcert-sanscache versions before 0.4.7. The generateDevCert function accepts a commonName parameter from user input and passes it directly to an exec() call without proper sanitization. While the code attempted input validation with a regex pattern, the original pattern (^(.|\.){\1,64}$) was overly permissive and allowed special shell characters. An attacker can pass malicious input like "&touch Song&" to execute arbitrary commands. The vulnerability is remotely exploitable if the package is used in a networked service (e.g., certificate generation API), and requires no authentication. The fix (commit 571f4e6) restricted the regex to only alphanumeric characters and dots: ^([a-zA-Z0-9|\.]{1,64}$, effectively neutralizing the injection vector.
Affected products
- npm devcert-sanscache before 0.4.7
Timeline
- 2020-01-08: disclosed
- 2020-04-14: advisory
- 2020-04-14: patched: version 0.4.7 released with regex sanitization fix