Executive brief
logkitty is a popular logging utility for React Native development. The package fails to properly sanitize output before passing it to the shell, allowing attackers to inject and execute arbitrary shell commands. An attacker could leverage this to gain remote code execution and compromise development environments or build systems using the library.
Technical details
The vulnerability is a command injection flaw (CWE-94) in logkitty versions prior to 0.7.1. The root cause is the lack of output sanitization when handling shell command execution; user-controlled or log data is passed unsanitized to shell operations. The attack requires no authentication or user interaction—an attacker can trigger command execution by supplying malicious input through application logs processed by logkitty. Successful exploitation grants arbitrary code execution with the privileges of the process running logkitty. A fix was released in version 0.7.1.
Affected products
- logkitty logkitty before 0.7.1
Timeline
- 2020-06-05: disclosed: Advisory published
- 2020-04-07: patched: Fix merged in PR #18