Executive brief
The rpi npm package is a Node.js library that controls Raspberry Pi GPIO pins. The library passes unsanitized user input directly to system shell commands, allowing attackers to inject arbitrary OS commands and achieve remote code execution on systems using this library.
Technical details
The vulnerability is an OS command injection (CWE-78) in the GPIO class constructor and related methods in src/lib/gpio.js. The pinNumber parameter is concatenated directly into a shell command executed via child_process.exec() without any sanitization or validation. An attacker who can control the pinNumber argument passed to the GPIO constructor can inject shell metacharacters to execute arbitrary commands with the privileges of the Node.js process. The attack requires an application to use the rpi library and accept user-controlled input for GPIO pin numbers; no authentication is required if the application is directly exposed to untrusted input. A fix would involve using parameterized command execution or strict input validation.
Affected products
- npm rpi through 0.0.3
Timeline
- 2021-04-13: disclosed
- 2020-02-24: advisory: NVD publication date