CVE-2020-7629: npm install-package OS command injection in options argument

Executive brief

The install-package library, used for managing software package installations, contains a critical security flaw. An attacker can exploit this to run unauthorized commands on the underlying server or system. This could lead to a complete system takeover, data theft, or disruption of services.

Technical details

An OS command injection vulnerability (CWE-78) exists in the npm package 'install-package' through version 0.4.0. The vulnerability is located in the index.js file where the library fails to properly neutralize special elements within the 'options' argument before passing them to a system shell. A remote, unauthenticated attacker can exploit this by providing malicious input to the affected function, leading to arbitrary command execution with the privileges of the Node.js process. As of the latest advisory, no patched versions are available.

Affected products

• npm install-package <= 0.4.0

Timeline

• 2020-04-02: disclosed: NVD publication date
• 2022-02-10: advisory: GitHub Advisory published

References

• https://api.github.com/users/cookesan
• https://github.com/cookesan
• https://api.github.com/users/cookesan/gists%7B/gist_id%7D
• https://api.github.com/users/cookesan/repos
• https://avatars.githubusercontent.com/u/6601329?v=4
• https://api.github.com/users/cookesan/events%7B/privacy%7D