Executive brief
deferred-exec is a Node.js library that provides a simplified interface for executing system commands. A command injection vulnerability in the library allows an attacker to inject arbitrary shell commands through the command parameter, potentially leading to complete system compromise if the application processes untrusted input. Since there is no patched version available, affected applications must discontinue use of this library.
Technical details
The vulnerability is a classic command injection (CWE-78) affecting all versions of the deferred-exec npm package. The root cause is unsanitized command strings passed directly to child_process.exec() at line 42 in lib/deferred-exec.js. When applications call the exec() function with attacker-controlled command strings, shell metacharacters and command separators are not escaped, allowing injection of arbitrary shell commands. The attack vector is local or network-based depending on how the library is called within the application. An attacker can inject commands using shell operators (;, |, &&, ||, etc.) to execute arbitrary code with the privileges of the Node.js process. There is no patched version available; the library must be replaced or discontinued.
Affected products
- npm deferred-exec all versions up to and including 0.3.1
Timeline
- 2021-01-26: disclosed: Vulnerability disclosed by JHU System Security Lab
- 2022-07-26: advisory: GitHub advisory GHSA-54w4-2f2p-f48h published