Executive brief
image-tiler is a Node.js library used for image tiling and processing. A command injection vulnerability allows attackers to execute arbitrary shell commands through unsanitized input, potentially leading to complete compromise of systems using the library. Exploitation requires no authentication and can be triggered remotely over the network.
Technical details
image-tiler contains a command injection vulnerability (CWE-77) in versions prior to 2.0.2, where user-controlled input is passed unsafely to shell commands without proper sanitization or escaping. The vulnerability is network-accessible and requires no authentication or user interaction. An attacker can inject arbitrary shell commands to achieve remote code execution with the privileges of the application process. The fix is available in version 2.0.2 and later.
Affected products
- MrP image-tiler < 2.0.2
Timeline
- 2022-08-03: disclosed
- 2022-08-02: advisory