Executive brief
geojson2kml is a Node.js library that converts geographic data formats. The library contains a command injection vulnerability in its core processing code that allows unauthenticated attackers to execute arbitrary system commands on servers running the affected package, potentially leading to complete system compromise including data theft, modification, or service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the index.js file of geojson2kml that allows arbitrary OS command execution. The library fails to properly sanitize user-supplied input before passing it to shell command execution. An attacker can exploit this by sending malicious input containing shell metacharacters (e.g., "&" followed by shell commands) as a function parameter. The attack requires network access to an application using the vulnerable library but does not require authentication or user interaction. A successful exploit grants the attacker the ability to execute arbitrary commands with the privileges of the Node.js process. No fix has been released; affected versions are 0.1.1 and earlier.
Affected products
- npm geojson2kml 0.1.1 and earlier
Timeline
- 2020-12-11: disclosed
- 2021-02-23: advisory
- 2021-05-10: other: GitHub Security Advisory published