Executive brief
Limdu is a Node.js machine learning library used for training classifiers. The trainBatch function contains a command injection vulnerability when used with shell-based classifiers like SVM Perf, SVM Linear, or Adaboost. An attacker with high privileges could inject arbitrary commands to achieve limited data exposure or modification.
Technical details
The vulnerability is a command injection (CWE-78) in the trainBatch function when processing classifiers that rely on shell execution. The attack requires high privilege level (PR:H) to exploit and does not require user interaction (UI:N). An attacker can inject shell commands through the trainBatch parameters, gaining the ability to read or modify data without affecting system availability. The vulnerability has been patched in version 0.9.5 of the library.
Affected products
- Limdu Limdu <=0.9.4
Timeline
- 2020-06-15: disclosed
- 2020-06-22: patched: Version 0.9.5 released