Executive brief
node-key-sender is a Node.js library that sends keyboard events to the operating system. The library fails to validate user-supplied arguments in its execute() function, allowing an attacker to inject arbitrary OS commands that will be executed with the privileges of the application. An attacker exploiting this vulnerability could execute malicious code, potentially compromising system security and data.
Technical details
The vulnerability is a classic command injection flaw (CWE-78) in the node-key-sender library. The execute() function uses the child_process.exec() method to invoke system commands but fails to properly sanitize or validate the arrParams argument passed by users. An attacker can craft a malicious array parameter containing shell metacharacters (such as "&" or ";") to break out of the intended command context and inject arbitrary commands. The attack requires only network access if the vulnerable application exposes the execute() function via a remote interface, or local access if attacking an installed application directly. No authentication or special privileges are required from the attacker's perspective. Successful exploitation allows execution of arbitrary OS-level commands with the permissions of the Node.js process. The library maintainers have not released a patched version, and the project appears unmaintained.
Affected products
- garimpeiro-it node-key-sender through 1.0.11
Timeline
- 2020-04-02: disclosed: Vulnerability disclosed to NVD
- 2022-02-10: advisory: GHSA-4xrw-wvmq-8jmh advisory published