Executive brief
node-prompt-here is a Node.js library used to open a console window in a specified directory. The library contains an OS command injection vulnerability that allows an attacker to execute arbitrary system commands by manipulating an environment variable. This could give an attacker complete control over the affected system, including access to sensitive data and the ability to disrupt operations.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in the runCommand() function within linux/manager.js. The function constructs shell commands using an unsanitized environment variable (process.env.NM_CLI) that is passed directly to execSync() without any input validation or escaping. An attacker who can control the NM_CLI environment variable (e.g., through application configuration or process environment) can inject arbitrary shell metacharacters and commands. No privileges or user interaction are required for exploitation. There is no fixed version available for this library.
Affected products
- node-prompt-here node-prompt-here through 1.0.1
Timeline
- 2020-03-13: disclosed
- 2021-05-07: advisory