Executive brief
node-df is a Node.js library used to retrieve disk free space information. The library fails to properly sanitize filenames passed through its file option, allowing attackers to inject arbitrary commands that execute on the server hosting the application. This could enable complete system compromise including data theft, service disruption, or installation of malware.
Technical details
The vulnerability is a command injection flaw (CWE-94) in the node-df library that arises from insufficient input sanitization of the file option parameter. When user-controlled input is passed to this parameter without proper escaping or validation, attackers can inject shell metacharacters to break out of the intended command context and execute arbitrary OS commands. The vulnerability is network-accessible if the application exposing this parameter is web-facing and requires no authentication. The attack results in remote code execution with the privileges of the application process. No patch is currently available; users are advised to switch to alternative packages.
Affected products
- npm node-df 0.1.4 and earlier
Timeline
- 2019-12-18: disclosed
- 2020-02-14: advisory