Executive brief
ts-process-promises is a Node.js library that executes system commands through a Promise-based interface. A command injection flaw allows attackers to inject arbitrary shell commands without authentication, leading to complete compromise of the system running applications that use this library. An attacker can execute arbitrary code, steal data, modify files, or disable services.
Technical details
The vulnerability is a command injection (CWE-78) located at line 45 in lib/process-promises.js in the exec() function. The library fails to properly sanitize user-supplied input before passing it to shell execution, allowing attackers to inject arbitrary commands. No authentication or user interaction is required; a network-reachable application using this library can be exploited remotely. An attacker can achieve remote code execution with the privileges of the application process. No patched version exists; the package is abandoned and unfixed.
Affected products
- <UNKNOWN> ts-process-promises 1.0.2 and all 1.x versions
Timeline
- 2020-12-04: disclosed
- 2021-01-08: advisory: NVD published
- 2021-01-13: advisory: GHSA published