Executive brief
Total.js is a popular Node.js framework used to build web, desktop, and IoT applications. A security flaw in the framework allows an attacker to execute arbitrary commands on the server hosting the application. This could lead to a complete system takeover, theft of sensitive customer data, or a total disruption of services.
Technical details
A Remote Code Execution (RCE) vulnerability exists in the total.js framework due to improper input validation in the 'set' utility function (U.set). The vulnerability is classified as Code Injection (CWE-94), where the 'path' argument of the function can be manipulated to execute arbitrary JavaScript code, such as through the use of eval() or child_process.execSync(). An attacker can exploit this over the network without any prior authentication or user interaction. If successful, the attacker gains the ability to execute system-level commands with the privileges of the Node.js process. The issue is resolved in version 3.4.8.
Affected products
- totaljs total.js < 3.4.8
Timeline
- 2021-02-19: disclosed: Vulnerability disclosed by Snyk security team.
- 2021-03-04: advisory: NVD and Snyk published advisories.
- 2021-03-19: advisory: GitHub Advisory published.