Executive brief
diskusage-ng is a Node.js library used to retrieve disk usage information. A security vulnerability in this library allows an attacker to execute arbitrary operating system commands by providing a specially crafted file path. This could lead to a complete takeover of the server running the application, unauthorized data access, or service disruption.
Technical details
The diskusage-ng library (versions up to and including 0.2.4) is vulnerable to OS command injection (CWE-78). The vulnerability exists in the way the library handles the 'path' argument, which is passed to the underlying 'df' system command via the 'execFile' function in 'lib/posix.js'. Because the input is not properly sanitized or validated, an attacker can inject shell metacharacters (e.g., using quotes and ampersands) to execute arbitrary commands on the host system. This can be achieved remotely if the application exposes the disk usage functionality to user-supplied input. The issue is resolved in version 1.0.0.
Affected products
- iximiuz diskusage-ng <= 0.2.4
Timeline
- 2020-04-05: disclosed: Vulnerability disclosed by Snyk and JHU System Security Lab
- 2020-04-06: advisory: NVD published CVE-2020-7631
- 2022-01-07: advisory: GitHub Advisory GHSA-3269-x4pw-vffg published