Executive brief
The devcert library, used by developers to generate local SSL certificates for development environments, contains a security flaw that allows for remote code execution. If an application using this library passes untrusted user input into the certificate generation function, an attacker could take full control of the underlying system. This could lead to the theft of sensitive data, unauthorized access to development environments, or the disruption of local services.
Technical details
A command injection vulnerability exists in the devcert npm module due to improper neutralization of special elements used in OS commands (CWE-78/CWE-77). The vulnerability is located within the `certificateFor` function, which fails to adequately sanitize inputs before using them in system command execution. An attacker can exploit this by providing crafted strings as input to the function, leading to arbitrary remote code execution (RCE) with the privileges of the application process. This issue is reachable over the network if the application exposes functionality that triggers certificate generation based on user-provided data. The vulnerability is fixed in version 1.1.2.
Affected products
- devcert_project devcert <= 1.1.1
Timeline
- 2020-07-10: disclosed: NVD publication date
- 2021-05-18: advisory: GitHub Advisory published
- 2020-07-10: patched: Fix version 1.1.2 released around NVD disclosure