Executive brief
umount is a Node.js package that wraps the UNIX umount system call to safely unmount file systems. The package fails to sanitize the device name parameter before passing it to shell execution, allowing an attacker to inject arbitrary shell commands. An attacker who controls the device parameter can execute code with the privileges of the process running the application, potentially compromising system integrity and confidentiality.
Technical details
This is a classic command injection vulnerability (CWE-78) in the umount npm package. The vulnerable code takes the user-supplied device parameter and passes it directly to an exec() call without sanitization, allowing shell metacharacters to break out of the intended umount command. An attacker can inject commands by passing specially crafted strings like `" $(touch Song) "` as the device argument. No authentication or user interaction is required—only that the device parameter be attacker-controlled. Exploitation results in arbitrary code execution with the privileges of the calling process. No fix is currently available; the package maintainers recommend using an alternative.
Affected products
- npm umount all versions up to and including 1.1.6
Timeline
- 2020-04-02: disclosed
- 2020-06-10: advisory