CVE-2020-7646: curlrequest OS command injection in options values

Executive brief

curlrequest is a library used by developers to make web requests. A security flaw allows attackers to run unauthorized commands on the server by including special characters in the request options. This could lead to a full system takeover or data theft.

Technical details

The curlrequest package for Node.js is vulnerable to OS command injection (CWE-78). The vulnerability exists because the library fails to properly neutralize special characters, specifically the semicolon (';'), when constructing shell commands from the 'options' object. An attacker can provide a crafted options value containing a semicolon followed by arbitrary shell commands, which will then be executed with the privileges of the Node.js process. This is a remote, unauthenticated attack vector. As of the advisory date, no patched version is available.

Affected products

• npm curlrequest <= 1.0.1

Timeline

• 2020-05-12: disclosed: GitHub reviewed the vulnerability
• 2020-05-13: advisory: Advisory published to GitHub Advisory Database

References

• https://api.github.com/users/cookesan
• https://github.com/cookesan
• https://api.github.com/users/cookesan/gists%7B/gist_id%7D
• https://api.github.com/users/cookesan/repos
• https://avatars.githubusercontent.com/u/6601329?v=4
• https://api.github.com/users/cookesan/events%7B/privacy%7D