Executive brief
gulp-styledocco is a documentation generation plugin for the Gulp build tool. The plugin fails to sanitize user-supplied input passed through its configuration options, allowing attackers to inject and execute arbitrary system commands on machines running the build process.
Technical details
The vulnerability is an OS command injection (CWE-78) in the exports function of index.js in gulp-styledocco. User-controlled options passed to the plugin are not sanitized before being used in system commands, allowing an attacker to break out of the intended command context and execute arbitrary OS commands. The attack requires the attacker to control the plugin configuration (e.g., via a malicious build script or build configuration file), but does not require authentication or network access. An attacker can achieve arbitrary code execution with the privileges of the process running the build. There is no fixed version; the package appears to be unmaintained.
Affected products
- gulp-styledocco gulp-styledocco through 0.0.3
Timeline
- 2020-03-13: disclosed
- 2021-05-07: advisory