Executive brief
The npm launchpad package, a development utility used to manage application processes, is vulnerable to command injection through its stop function. An attacker can execute arbitrary system commands by providing malicious input, potentially gaining full control over the system running the application.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the launchpad package's stop function. All versions through 0.7.5 are affected. The root cause stems from insufficient input validation or sanitization when processing parameters passed to the stop function, allowing an unauthenticated attacker to inject arbitrary shell commands. The attack requires no authentication or user interaction and can be exploited over the network if launchpad is exposed or used in a networked context. Successful exploitation allows arbitrary command execution with the privileges of the process running launchpad. A patch is available in versions after 0.7.5 (reference: GitHub PR #124).
Affected products
- Bitovi launchpad 0.7.5 and earlier
Timeline
- 2021-02-01: disclosed: NVD publication date
- 2021-04-13: advisory: GitHub Security Advisory GHSA-7h8x-wmq2-7mff published
- 2021-03-22: patched: Fix available (GitHub PR #124)