Executive brief
curljs is a Node.js package that wraps curl functionality into an easy-to-use module. The package is vulnerable to command injection attacks that allow unauthenticated remote attackers to execute arbitrary system commands on the host system, potentially leading to complete system compromise, data theft, or service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-78) affecting all versions of curljs up to version 0.1.2. The root cause is improper sanitization of user input before passing arguments to shell commands via curl. An attacker can inject shell metacharacters and commands through the API to execute arbitrary system commands with the privileges of the Node.js process. No authentication or user interaction is required; exploitation is straightforward and can be triggered over the network if the application exposes curljs functionality. The vulnerability has a proof-of-concept demonstration available. No fixed version has been released; applications using curljs should consider migrating to alternative packages.
Affected products
- npm curljs all versions up to 0.1.2
Timeline
- 2020-12-11: disclosed
- 2022-08-03: advisory