Executive brief
node-dns-sync is a Node.js library for DNS lookups. The library improperly handles untrusted input when constructing system commands, allowing attackers to execute arbitrary code. An application using this library could be compromised if it processes attacker-controlled domain names or DNS parameters.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-94) in node-dns-sync versions through 0.2.0. The library constructs shell commands for DNS operations without properly sanitizing or escaping user-supplied input, allowing an attacker to inject arbitrary shell metacharacters. The attack requires that an application using the library passes untrusted input (such as a user-supplied domain name) directly to the vulnerable method. Successful exploitation results in remote code execution with the privileges of the Node.js process. The issue has been patched in version 0.2.1.
Affected products
- npm dns-sync through 0.2.0
Timeline
- 2020-05-22: disclosed
- 2020-05-28: advisory
- 2020-05-28: patched: Fixed in version 0.2.1