Executive brief
The buns npm package is a Node.js library used for managing module installation. A command injection flaw in its core install function allows attackers to execute arbitrary system commands on any machine running vulnerable versions of the package. This could lead to complete system compromise, data theft, or use of the affected server as a staging point for attacks on other systems.
Technical details
A command injection vulnerability (CWE-78, CWE-77) exists in the buns npm package affecting all versions up to and including 1.1.6. The vulnerability is located in the install() function at lib/index.js line 678, where user-supplied input from the requestedModule parameter is passed unsanitized to a shell command execution context. The attack requires only network access; no authentication or user interaction is needed. An attacker can craft a malicious module name containing shell metacharacters (e.g., "& touch JHU") to break out of the intended command and execute arbitrary code with the privileges of the process running buns. No patch has been released; the package should not be used.
Affected products
- npm buns 0 through 1.1.6
Timeline
- 2020-12-11: disclosed
- 2021-01-13: advisory