Junglewise Threat Intelligence

CVE-2020-7613: Clamscan command injection in _is_clamav_binary

CVE-2020-7613 · Severity: low · CVSS 3.1 · Published 2022-05-24

Vendors: npm.

Executive brief

Clamscan is a Node.js library used to scan files for viruses using ClamAV. An attacker could inject arbitrary system commands through specially crafted file paths, potentially achieving remote code execution on servers that use this library. This vulnerability requires the attacker to first create a folder with a malicious name, which limits its practical risk but still poses a significant threat to systems processing untrusted file uploads.

Technical details

Clamscan versions up to 1.2.0 are vulnerable to OS command injection in the _is_clamav_binary function within index.js. The vulnerability occurs when user-supplied input (file or directory paths) is passed unsanitized to shell execution without proper escaping or validation. An attacker can chain arbitrary commands by embedding shell metacharacters (such as &) in folder or file paths. While the vulnerability requires a precondition—the attacker must first create a folder with the malicious command embedded in its name—this can be achieved in scenarios where the application accepts user-controlled directory names or paths. The patch in version 1.3.0 properly escapes shell arguments to prevent command injection. The vulnerability is accessible over the network if the application exposes file upload or path configuration functionality.

Affected products

  • Kyle Farris clamscan <1.3.0

Timeline

  • 2020-04-07: disclosed
  • 2020-05-01: patched: Fix merged in PR #45
  • 2022-05-24: advisory: GHSA-5v25-xr56-phph published

References