Executive brief
Pulverizr is a Node.js library for compressing image files. The library contains an OS command injection vulnerability that allows an attacker to execute arbitrary system commands by crafting a malicious filename. This could enable an attacker to take control of the application's system privileges and compromise the host server.
Technical details
The vulnerability is an OS command injection flaw in the compress function of pulverizr's lib/job.js. The vulnerable code uses the exec() function from Node.js child_process module to copy files without properly sanitizing the filename parameter. Specifically, the line `exec('cp "' + filename + '" ' + scratchSpace, ...)` concatenates user-controlled filenames directly into a shell command. An attacker can inject shell metacharacters (e.g., backticks, semicolons, or pipes) in the filename to execute arbitrary commands. The vulnerability is exploitable whenever the library processes files with attacker-controlled names, requiring no authentication but user interaction in the form of providing a crafted filename.
Affected products
- pulverizr pulverizr all versions
Timeline
- 2021-05-07: disclosed
- 2021-05-07: advisory: GHSA-fmf5-j5j9-99pp published