CVE-2020-7626: karma-mojo OS command injection via config argument

Executive brief

karma-mojo is a software package used in development environments. A security flaw allows an attacker to run unauthorized commands on the underlying operating system by providing a malicious configuration argument. This could lead to a complete takeover of the system where the software is running, potentially exposing sensitive source code or development data.

Technical details

karma-mojo through version 1.0.1 contains an OS command injection vulnerability (CWE-78). The root cause is the improper neutralization of special elements within the 'config' argument, which is used to construct system commands. An attacker can exploit this by passing a crafted string to the config parameter, leading to arbitrary command execution with the privileges of the application process. The attack can be carried out over the network without authentication or user interaction. As of the latest advisory, there are no known patched versions available.

Affected products

• npm karma-mojo <= 1.0.1

Timeline

• 2020-04-02: disclosed: NVD publication date
• 2022-02-10: advisory: GitHub Advisory published

References

• https://api.github.com/users/cookesan
• https://github.com/cookesan
• https://api.github.com/users/cookesan/gists%7B/gist_id%7D
• https://api.github.com/users/cookesan/repos
• https://avatars.githubusercontent.com/u/6601329?v=4
• https://api.github.com/users/cookesan/events%7B/privacy%7D