CVE-2020-7623: jscover OS command injection in source argument

Executive brief

jscover is a tool used by developers to measure how much of their JavaScript code is tested. A security flaw allows an attacker to remotely execute unauthorized commands on the system running this tool. This could lead to a full system takeover, data theft, or disruption of the software development process.

Technical details

jscover through version 1.0.0 contains an OS command injection vulnerability (CWE-78) within its core logic. The vulnerability exists because the application fails to properly neutralize special elements in the 'source' argument before using it to construct and execute a system command. An unauthenticated remote attacker can exploit this by providing a specially crafted string to the affected argument, leading to arbitrary command execution with the privileges of the application. As of the latest advisory, there are no known patched versions available.

Affected products

• node-modules jscover <= 1.0.0

Timeline

• 2020-04-02: disclosed: NVD publication date
• 2022-02-10: advisory: GitHub Advisory published

References

• https://api.github.com/users/cookesan
• https://github.com/cookesan
• https://api.github.com/users/cookesan/gists%7B/gist_id%7D
• https://api.github.com/users/cookesan/repos
• https://avatars.githubusercontent.com/u/6601329?v=4
• https://api.github.com/users/cookesan/events%7B/privacy%7D