Executive brief
docker-compose-remote-api is a Node.js library that provides an interface between docker-compose and Docker's Remote API. The package contains an OS command injection vulnerability in its exec() function that allows attackers to execute arbitrary shell commands without authentication by injecting shell metacharacters into the serviceName parameter.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in the exec(serviceName, cmd, fnStdout, fnStderr, fnExit) function within index.js. The serviceName parameter is passed directly to a shell command without sanitization or escaping, allowing an attacker to inject arbitrary shell metacharacters (e.g., "&") to execute additional commands. The attack requires no authentication and is network-reachable if the package is exposed via an API endpoint. An attacker can achieve arbitrary code execution on the host system running the vulnerable application. No patched version has been released; the vulnerability affects all versions through 0.1.4 with no fix available.
Affected products
- docker-compose-remote-api docker-compose-remote-api through 0.1.4
Timeline
- 2020-03-13: disclosed
- 2021-05-07: advisory: GHSA-q6pj-jh94-5fpr published