Executive brief
wifiscanner is a Node.js library used to scan for WiFi networks. The library fails to properly validate user-supplied options for binary path and arguments, allowing attackers to inject arbitrary operating system commands that execute with the privileges of the application. This could enable complete compromise of systems running vulnerable versions of the library.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in the wifiscanner.js module. The root cause is improper input validation of user-supplied options (binaryPath and args) before passing them to childProcess.exec(). An attacker can provide malicious command-line arguments or binary paths to execute arbitrary shell commands. No authentication or user interaction is required—any application using the library with untrusted input can be exploited. An attacker can achieve remote code execution with the privileges of the Node.js process. All versions through 1.0.1 are affected; a patch status is unknown.
Affected products
- thingsSDK wifiscanner through 1.0.1
Timeline
- 2020-06-11: disclosed: Issue reported on GitHub
- 2020-06-29: advisory: Published to NVD
- 2021-05-17: other: GHSA advisory published