Executive brief
Locutus is a library that provides PHP standard library functions reimplemented in TypeScript/JavaScript. A command injection vulnerability in the escapeshellarg function allows remote attackers to execute arbitrary system commands on servers using affected versions, potentially leading to complete system compromise.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the escapeshellarg function implementation within Locutus PHP through version 2.0.11. The vulnerable function fails to properly sanitize user-controlled input before passing it to shell commands, allowing an attacker to inject arbitrary shell metacharacters and escape sequences. The attack requires no authentication and is network-reachable via any application using the vulnerable function to process untrusted input. A successful exploit grants the attacker remote code execution with the privileges of the application process. Patches are available in versions after 2.0.11.
Affected products
- Locutus Locutus through 2.0.11
Timeline
- 2020-07-01: disclosed
- 2021-07-26: advisory