Executive brief
closure-compiler-stream is a Node.js library that provides a streaming interface to the Google Closure Compiler, a tool used to minify and optimize JavaScript code. The library fails to sanitize user-supplied options passed to the compiler, allowing attackers to inject arbitrary operating system commands that execute with the privileges of the Node.js process. This could lead to unauthorized code execution, data theft, or system compromise.
Technical details
The vulnerability is an OS command injection (CWE-78) in the exports function of index.js. The `options` parameter accepted by the closure-compiler-stream module is passed unsanitized to shell command execution, allowing attackers to inject shell metacharacters and arbitrary commands. An attacker can control the options argument without any validation or escaping, typically through configuration or API calls in an application that uses this library. The proof-of-concept demonstrates injection via the `module` option array, where shell command syntax can be embedded. There is no patched version available; the project appears to be abandoned or unmaintained.
Affected products
- npm closure-compiler-stream through 0.1.15
Timeline
- 2020-03-13: disclosed
- 2021-05-07: advisory: GitHub advisory GHSA-m647-5wf9-3jp3 published