Executive brief
corenlp-js-interface is a Node.js library for interfacing with Stanford CoreNLP, used for natural language processing tasks. The library is vulnerable to command injection through its main function, allowing an attacker to execute arbitrary system commands. This could lead to complete compromise of any application using the library, with potential for data theft, system manipulation, or service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the main function of corenlp-js-interface that fails to properly sanitize user-supplied input before passing it to shell execution. An unauthenticated remote attacker can exploit this by injecting shell metacharacters into the function parameters (e.g., "') touch JHU # '") to execute arbitrary system commands with the privileges of the application process. No authentication or user interaction is required; the attack is network-accessible. The package is deprecated with no fixed version available.
Affected products
- corenlp-js-interface corenlp-js-interface all versions up to 1.0.3
Timeline
- 2020-12-11: disclosed
- 2020-12-18: advisory