Executive brief
The fsa (File System Auditor) library is a tool used to monitor and audit file system changes. A security flaw allows an attacker with local access to execute unauthorized system commands by manipulating inputs passed to the library's Git integration features. This could lead to a full system compromise, unauthorized data access, or the ability to modify sensitive files.
Technical details
The fsa package (up to and including version 0.5.1) is vulnerable to OS command injection. The root cause is the lack of sanitization of the first argument passed to the 'execGitCommand()' function in 'lib/rep.js'. This argument is concatenated into a shell command string and executed using the Node.js 'child_process.exec' method. A local attacker can provide a malicious string (e.g., using shell metacharacters like '&' or ';') to execute arbitrary system commands with the privileges of the application process. As of the advisory date, there is no known fixed version available.
Affected products
- gregof fsa <= 0.5.1
Timeline
- 2020-04-01: disclosed: Vulnerability disclosed by Snyk and JHU System Security Lab.
- 2020-04-07: advisory: NVD published CVE-2020-7615.
- 2021-12-09: advisory: GitHub Advisory published.