Executive brief
The codecov NPM module is a utility used by development teams to upload code coverage reports to the Codecov service. A command injection vulnerability in the gcov-root argument handler allows authenticated attackers with local access to the build system to execute arbitrary commands with the privileges of the build process, potentially compromising CI/CD pipelines and introducing malicious code into production.
Technical details
The codecov-node NPM module (versions before 3.6.5) contains a command injection vulnerability in lib/codecov.js where the gcov-root argument value is passed unsanitized to the exec function. An attacker can inject arbitrary shell commands by including shell metacharacters (e.g., "& touch exploit &") in the gcov-root parameter. The vulnerability requires authentication (a user must call the vulnerable function) but the attack vector is network-accessible as it can be exploited through module usage in CI/CD systems. This is an incomplete fix of CVE-2020-7596. The fix in version 3.6.5 properly escapes arguments before execution.
Affected products
- codecov codecov before 3.6.5
Timeline
- 2020-02-16: disclosed
- 2020-02-19: advisory
- 2020-02-19: patched: version 3.6.5 released