Executive brief
The curling npm package is a Node.js library for making HTTP requests via curl. Versions before 1.1.0 fail to sanitize user input passed to the run function, allowing attackers to inject arbitrary shell commands that execute with the privileges of the application.
Technical details
The curling package contains an OS command injection vulnerability (CWE-78) in the run function, where user-controlled command arguments are passed directly to child_process.exec() without sanitization. The vulnerable code concatenates user input into a shell command string: exec("curl " + command, ...). An attacker can exploit this by providing a malicious command argument containing shell metacharacters to execute arbitrary OS commands. The vulnerability requires the application to accept and pass untrusted input to the run function. The issue was fixed in version 1.1.0.
Affected products
- npm curling <1.1.0
Timeline
- 2020-02-06: disclosed: CVE-2019-10789 published on NVD
- 2021-04-13: advisory: GHSA-xmxh-g7wj-8m4m published
- 2021: patched: Fixed in version 1.1.0