Executive brief
connection-tester is a Node.js library used to test network connectivity to remote hosts and ports. A command injection vulnerability in versions before 0.2.1 allows attackers to execute arbitrary system commands by injecting shell metacharacters into the host or port parameters, potentially leading to system compromise or data exfiltration.
Technical details
This vulnerability is a command injection flaw (CWE-78) located in index.js line 15 of the connection-tester npm package. The vulnerable code fails to properly validate or sanitize host and port inputs before passing them to shell execution, allowing an attacker to inject arbitrary OS commands. The attack requires network accessibility to code that calls the vulnerable function with untrusted input; no authentication is required. An unauthenticated attacker can achieve remote code execution with the privileges of the process running the vulnerable application. The vulnerability was patched in version 0.2.1 with input validation for hostname and port values.
Affected products
- npm connection-tester before 0.2.1
Timeline
- 2020-12-16: disclosed: CVE-2020-7781 published by NVD
- 2020-12-17: disclosed: GHSA-w5mp-8p8w-mhh8 published
- 2020-12-16: patched: Patch merged in PR #10 with input validation