Executive brief
im-resize is a Node.js library for image resizing. The vulnerability allows attackers to execute arbitrary commands on the server by injecting malicious input through the resize function. This could lead to complete system compromise, data theft, or service disruption for any application using this library.
Technical details
A command injection vulnerability (CWE-78) exists in im-resize through version 2.3.2 where user-supplied arguments are passed unsanitized to shell commands in index.js. The "cmd" argument can be controlled by an attacker without input validation. An unauthenticated attacker can send a network request with a crafted payload to execute arbitrary OS commands with the privileges of the application process. The vulnerability affects all versions up to and including 2.3.2; patched versions exist.
Affected products
- im-resize im-resize through 2.3.2
Timeline
- 2020-02-04: disclosed
- 2021-04-13: advisory