Executive brief
ffmpeg-sdk is a JavaScript library that wraps the FFmpeg video processing tool, commonly used in Node.js applications to manipulate and convert multimedia files. A command injection vulnerability allows attackers to execute arbitrary operating system commands by manipulating input parameters (like file paths or durations) that are directly interpolated into shell commands without sanitization. An attacker could gain full system access or compromise data on servers running vulnerable applications.
Technical details
This is a classic OS command injection vulnerability (CWE-77/CWE-78) in which user-controlled input is directly concatenated into shell commands executed via child_process.exec(). The vulnerable code constructs FFmpeg commands by string interpolation of parameters like inputFilePath, outputFilePath, startTime, and duration without escaping or validation. The attack vector is network-adjacent, assuming the library is exposed through a web service or application API that accepts file paths or timing parameters from users. An attacker can inject shell metacharacters (e.g., semicolons, pipes, or command substitution) to execute arbitrary commands with the privileges of the Node.js process. All versions through 0.0.5 are affected; no patch information is available in the advisory.
Affected products
- CubetLabs ffmpeg-sdk all versions through 0.0.5
Timeline
- 2022-07-26: disclosed