Executive brief
adb-driver is a Node.js library for interacting with Android devices via USB. The library fails to sanitize user-supplied command input before passing it to the operating system shell, allowing attackers to execute arbitrary commands with the privileges of the process running the application. A compromised application could lead to data theft, system manipulation, or use as a foothold for further attacks.
Technical details
adb-driver contains an OS command injection vulnerability (CWE-78) in the execADBCommand function at line 26 of build/AdbDriver.js. The vulnerability occurs because the command parameter is passed directly to system execution without any input sanitization or escaping. An attacker who can control the command argument (for example, by calling execADBCommand(' & touch Song')) can inject arbitrary shell metacharacters and commands. The attack vector is local-to-network depending on how the vulnerable library is exposed; if used in a web application or service, remote code execution is possible. There is no patched version available; the maintainers have not released a fix as of the advisory publication date.
Affected products
- adb-driver project adb-driver through 0.1.8
Timeline
- 2020-04-06: disclosed: CVE published; Snyk PoC released
- 2021-12-09: advisory: GitHub Security Advisory GHSA-4m6q-rxhm-675w published