Executive brief
network-manager is a Node.js library for managing Ethernet and WiFi network interfaces. A command injection vulnerability allows remote attackers to execute arbitrary system commands by manipulating environment variables passed to shell execution functions, potentially compromising the host system.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the runCommand() function within common.js, which is called by getDevices() in linux/manager.js. The function constructs arguments for execSync() using unsanitized input from process.env.NM_CLI, which can be controlled by an attacker without validation. An attacker can inject shell metacharacters and commands through the environment variable, leading to arbitrary command execution. The affected versions are through 1.0.2, and no patched version is currently available.
Affected products
- npm network-manager through 1.0.2
Timeline
- 2020-02-04: disclosed
- 2021-04-13: advisory