Executive brief
heroku-addonpool is a Node.js library used to manage pools of add-ons for Heroku applications. A security flaw allows an attacker to execute unauthorized operating system commands on the server running this library. This could lead to a full system takeover, unauthorized access to sensitive Heroku configuration data, or disruption of cloud operations.
Technical details
The heroku-addonpool package through version 0.1.15 is vulnerable to OS command injection (CWE-78). The vulnerability exists because the second parameter ('app') of the exported HerokuAddonPool(id, app, opt) function is passed to child_process.exec() without sufficient sanitization or validation. An attacker who can control this input can inject shell metacharacters (e.g., '&' or ';') to execute arbitrary commands with the privileges of the Node.js process. While a regex check (RAPP) was present in some versions, it was insufficient to prevent injection in all execution paths, such as the setup() and supplySet() methods. The issue is fixed in version 0.1.16.
Affected products
- nodef heroku-addonpool <= 0.1.15
Timeline
- 2020-04-05: disclosed: Vulnerability disclosed by Snyk and JHU System Security Lab
- 2020-04-06: advisory: NVD published CVE-2020-7634
- 2020-04-06: patched: Fix committed to GitHub repository