Executive brief
im-metadata is a Node.js library used to extract metadata from image files. The library allows remote attackers to execute arbitrary operating system commands by injecting malicious input into metadata processing options, potentially leading to complete system compromise.
Technical details
The vulnerability is an OS command injection (CWE-78) in im-metadata through version 3.0.1. The "exec" argument used by the library to process metadata fails to properly sanitize user-supplied input, allowing attackers to inject arbitrary shell commands as part of metadata options. No authentication or user interaction is required; the attack is network-accessible if the library is used in a web-facing application. Exploitation allows remote code execution with the privileges of the application process. A patch was committed to the upstream repository (commit ea15ddd) to address this vulnerability.
Affected products
- Turistforeningen im-metadata through 3.0.1
Timeline
- 2020-02-04: disclosed
- 2021-04-13: advisory
- 2020: patched: Fix committed upstream (commit ea15dddbe0f65694bfde36b78dd488e90f246639)