Executive brief
sonar-wrapper is a Node.js utility wrapper for SonarQube, a code quality analysis platform. A command injection vulnerability in the library allows attackers to execute arbitrary commands, potentially compromising build systems and enabling code analysis tampering or system compromise.
Technical details
A command injection vulnerability exists in lib/sonarRunner.js of sonar-wrapper affecting all released versions. The vulnerability stems from improper sanitization of user-controlled input that is passed to shell command execution, allowing CWE-77 command injection. The attack vector is network-accessible with no authentication or user interaction required. An unauthenticated attacker can inject arbitrary commands that execute with the privileges of the process running sonar-wrapper, leading to complete system compromise. No official patch information is available in the advisory; users should audit dependencies and consider alternatives.
Affected products
- <UNKNOWN> sonar-wrapper 0 to 0.1.3
Timeline
- 2022-07-26: disclosed: GHSA advisory published
- 2022-07-25: other: NVD entry published for CVE-2020-28443