Executive brief
strong-nginx-controller is a module providing reverse-proxy and load-balancing capabilities for StrongLoop application server deployments. The vulnerability allows unauthenticated attackers to execute arbitrary operating system commands on the server, potentially compromising the entire application infrastructure. An attacker can bypass the application layer entirely and take control of the underlying system, affecting all services proxied through the controller.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in the _nginxCmd() function within lib/server.js. The first argument passed to this function is concatenated directly into a shell command without any input validation or sanitization, allowing an attacker to inject shell metacharacters (e.g., &, |, ;) to execute arbitrary commands. The vulnerable code path is reachable over the network with no authentication required. Exploitation requires only the ability to call the _nginxCmd() function with attacker-controlled input; proof-of-concept demonstrates injecting commands like "touch Song" by passing "& touch Song" as the first argument. No patch has been released for this package.
Affected products
- StrongLoop strong-nginx-controller through 1.0.2
Timeline
- 2020-04-02: disclosed: Disclosed via NVD and Snyk
- 2022-02-10: advisory: GHSA-4v9w-pvwr-38h3 published