Executive brief
hot-formula-parser is a JavaScript library used to parse and evaluate spreadsheet-like formulas. Versions before 3.0.1 contain a critical command injection vulnerability: the library fails to sanitize user input before passing it to an eval() function, allowing attackers to execute arbitrary code and commands on servers running the library. This could lead to complete system compromise, data theft, or service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-94) in the formula parsing logic. The parse() function concatenates unsanitized, user-controlled input directly into an eval() call without any validation or sanitization. An attacker can craft a malicious formula string (e.g., "SUM([(function(){require('child_process').execSync('touch test')})(),2])") that executes arbitrary Node.js code when parsed. The attack requires no authentication and is reachable over the network if the application exposes the parsing function. The vulnerability was fixed in version 3.0.1 by removing the use of eval().
Affected products
- handsontable hot-formula-parser <3.0.1
Timeline
- 2020-05-06: disclosed
- 2020-05-06: patched: Version 3.0.1 released