Executive brief
promise-probe is a Node.js library used for network connectivity testing and probing. A command injection vulnerability in versions before 0.10.0 allows attackers to execute arbitrary operating system commands through unsanitized user inputs in the file, outputFile, and options parameters. An attacker can exploit this to achieve remote code execution on systems running vulnerable versions of the library.
Technical details
The vulnerability is a classic OS command injection (CWE-78) affecting promise-probe before version 0.10.0. The file, outputFile, and options functions accept user-controlled parameters without proper sanitization or input validation before passing them to shell commands. This allows an attacker to inject arbitrary OS commands that will be executed with the privileges of the Node.js process. The attack is network-accessible and requires no authentication or user interaction. An attacker can achieve full remote code execution. The fix is available in version 0.10.0 and later, which properly sanitizes inputs.
Affected products
- dottgonzo promise-probe before 0.10.0
Timeline
- 2020-02-18: disclosed: CVE-2019-10791 published in NVD
- 0.10.0: patched
- 2022-05-24: advisory: GHSA-vmqq-7qvx-68qx published