Executive brief
bestzip is a Node.js library for creating ZIP archives programmatically. A command injection vulnerability in the options parameter allows attackers to execute arbitrary shell commands with the privileges of the application using the library. This could lead to complete system compromise if the application processes untrusted input.
Technical details
The vulnerability is a command injection flaw (CWE-78) in bestzip versions before 2.1.7, stemming from unsafe use of shell execution via child_process.exec() when processing the options parameter. An attacker can inject shell metacharacters into the options parameter to break out of the intended command context and execute arbitrary OS commands. No authentication or user interaction is required; exploitation occurs if an application passes untrusted data to bestzip's options. The fix migrated from cp.exec() to cp.spawn() to avoid shell interpretation and applied path expansion logic to prevent injection while maintaining feature parity.
Affected products
- bestzip bestzip < 2.1.7
Timeline
- 2020-09-04: disclosed
- 2021-05-06: advisory
- 2021-05-04: patched: Version 2.1.7 released with fix