Executive brief
The macfromip npm package is a utility that retrieves MAC addresses from LAN IP addresses. A command injection vulnerability in the package allows attackers to execute arbitrary system commands without authentication or user interaction, potentially leading to full system compromise including data theft, file modification, and service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-78) located in lines 66 and 96 of macfromip.js. The vulnerable functions getMacInLinux() and getMacInWin32() fail to properly sanitize user-supplied IP address input before passing it to shell execution calls. An attacker can inject shell metacharacters (e.g., "&") to execute arbitrary commands. The attack is network-reachable with no authentication or user interaction required. Exploitation allows arbitrary command execution in the context of the application process. No patched version exists; affected versions are 0 through 1.1.1 with no fix available from the maintainers.
Affected products
- npm macfromip all versions up to 1.1.1
Timeline
- 2020-12-04: disclosed: Vulnerability disclosed
- 2021-02-08: advisory: NVD published
- 2021-04-12: other: GitHub advisory GHSA-vh8f-xw5v-8993 published