Executive brief
xmlhttprequest and xmlhttprequest-ssl are Node.js libraries that provide XMLHttpRequest compatibility for server-side code. When making synchronous HTTP requests, malicious input in the request body can break out of a string context and execute arbitrary code on the server. This allows attackers to compromise applications that use these libraries with untrusted input.
Technical details
This vulnerability is a code injection flaw (CWE-94) in the xmlhttprequest and xmlhttprequest-ssl Node.js libraries. When synchronous requests (async=false) are made, the libraries construct shell commands by concatenating user-supplied data directly into a string without proper escaping. An attacker who can control the request body can inject shell metacharacters and arbitrary code that will be executed with the privileges of the Node.js process. No authentication is required; the vulnerability is exploitable when any untrusted input reaches the xhr.send() method. Patches are available in xmlhttprequest 1.7.0+ and xmlhttprequest-ssl 1.6.2+.
Affected products
- npm xmlhttprequest before 1.7.0
- npm xmlhttprequest-ssl all versions before 1.6.2
Timeline
- 2021-03-05: disclosed: Published on NVD
- 2021-05-04: advisory: GitHub advisory published
- 2021: patched: Patches released in xmlhttprequest 1.7.0 and xmlhttprequest-ssl 1.6.2