Executive brief
google-cloudstorage-commands is a Node.js library providing utilities to interact with Google Cloud Storage via the gcloud command-line tool. A command injection vulnerability in all versions allows attackers to execute arbitrary shell commands through unsanitized input parameters, potentially leading to unauthorized access to cloud storage buckets and data theft.
Technical details
The vulnerability is a command injection flaw (CWE-77) affecting all versions of the deprecated google-cloudstorage-commands npm package. The root cause is improper input validation in the library's core functionality (index.js, line 11), where user-supplied parameters are directly passed to shell command execution without sanitization. An attacker can inject arbitrary shell metacharacters or commands through function parameters such as inputDirectory, bucket, or other arguments. The attack requires network reachability to a system running the vulnerable library, with no authentication required if the application exposes these functions via an API or CLI. Successful exploitation allows remote code execution with the privileges of the process running the library. No patch is available as the package is officially deprecated.
Affected products
- npm google-cloudstorage-commands all versions including 0.0.1 and earlier
Timeline
- 2022-07-26: disclosed
- other: Package is deprecated and unmaintained