Executive brief
The linux-cmdline library, used for parsing Linux kernel command line arguments in JavaScript environments, is vulnerable to a security flaw called prototype pollution. An attacker can exploit this by providing specially crafted input that modifies the fundamental structure of JavaScript objects within the application. This can lead to application crashes, unauthorized data access, or potentially full system takeover depending on how the library is used.
Technical details
The linux-cmdline library (versions prior to 1.0.1) is vulnerable to Prototype Pollution (CWE-1321). The vulnerability exists in the argument parsing logic where the constructor does not properly sanitize property keys such as '__proto__'. A remote attacker can provide a malicious command-line string that, when parsed, injects properties into the global Object prototype. This can be leveraged to bypass security checks, cause a Denial of Service (DoS) by overwriting built-in methods, or achieve Remote Code Execution (RCE) if the polluted properties are later used in sensitive operations like eval() or template rendering. The issue was fixed in version 1.0.1 by improving input validation.
Affected products
- piranna linux-cmdline < 1.0.1
Timeline
- 2020-08-14: disclosed: Vulnerability disclosed by Snyk
- 2020-08-17: patched: Fix committed in version 1.0.1
- 2020-08-17: advisory: NVD published CVE-2020-7704