Executive brief
chrome-launcher is a Node.js library used to launch and control Google Chrome programmatically. Versions before 0.13.2 allow attackers to inject arbitrary commands through the HOME environment variable on Linux systems, potentially enabling remote code execution if the library is used in a web service or other networked context.
Technical details
chrome-launcher prior to 0.13.2 contains an OS command injection vulnerability (CWE-78) caused by unsanitized environment variables being directly embedded into regular expressions. Specifically, the $HOME environment variable is interpolated without escaping into RegExp patterns used for Chrome path detection on Linux. An attacker who can control the HOME environment variable can inject RegExp metacharacters or catastrophic backtracking patterns to either bypass path checks or cause denial of service. The vulnerability requires local environment variable manipulation; however, in containerized or shared hosting environments, this may be exploitable remotely. The issue is patched in version 0.13.2, which sanitizes environment variables before use in regular expressions.
Affected products
- Google chrome-launcher before 0.13.2
Timeline
- 2020-05-02: disclosed
- 2020-05-07: patched: Fixed in version 0.13.2