Executive brief
apiconnect-cli-plugins is a Node.js package used to manage plugins for IBM API Connect CLI tools. A command injection vulnerability in the plugin installation function allows attackers to execute arbitrary OS commands, potentially leading to full system compromise if the tool is run with elevated privileges.
Technical details
The vulnerability is a classic OS command injection (CWE-78) located in the installPlugin() function at line 181 of lib/plugin-loader.js. The pluginUri argument is passed unsanitized to a shell command, allowing an attacker to inject arbitrary shell metacharacters and execute commands. The attack requires invoking the vulnerable function directly via require(), which could occur if an attacker can control the pluginUri input or trick an application into calling installPlugin() with attacker-controlled data. No authentication or user interaction is required; successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the process running the Node.js application. Patches are not explicitly mentioned in the advisory; affected versions through 6.0.1 should be assumed vulnerable.
Affected products
- IBM apiconnect-cli-plugins through 6.0.1
Timeline
- 2020-04-06: disclosed
- 2021-05-24: advisory