Executive brief
Codecov is a code coverage reporting tool used by development teams to track test coverage across their codebases. The npm package contained a command injection vulnerability that allowed attackers to execute arbitrary commands by manipulating the "gcov-args" argument, potentially giving attackers full control over the build environment and access to sensitive credentials stored there.
Technical details
The Codecov npm module before version 3.6.2 fails to properly neutralize special elements in the "gcov-args" input parameter, allowing command injection via improper output handling in a downstream component (CWE-74). An authenticated attacker or malicious build configuration can inject shell metacharacters into the gcov-args argument, which are then executed by the system shell during code coverage processing. This requires either network access to a system running Codecov or control over build configuration/environment. An attacker can achieve arbitrary command execution in the context of the user running Codecov, potentially exfiltrating credentials or compromising the build pipeline. The vulnerability was fixed in version 3.6.2.
Affected products
- Codecov codecov < 3.6.2
Timeline
- 2020-01-25: disclosed: NVD published date
- 3.6.2: patched: Fix version released