Executive brief
onion-oled-js is a Node.js library that controls OLED displays on Onion Omega devices. A command injection vulnerability in the scroll function allows attackers to execute arbitrary system commands if they can control user input passed to that function, potentially compromising the device running the library.
Technical details
The vulnerability is a command injection (CWE-77) caused by unsanitized user input passed to Node.js child_process.exec() in the scroll function. An attacker who can control input to the scroll function can inject shell metacharacters to execute arbitrary commands with the privileges of the Node.js process. The vulnerability affects all versions up to and including 0.0.2. No network access is required if the attacker can provide input locally, though impact depends on how the library is deployed. A fix requires input validation and sanitization or use of child_process.execFile() with an arguments array instead of exec().
Affected products
- onion-oled-js onion-oled-js 0.0.2 and earlier
Timeline
- 2021-05-07: disclosed: Advisory GHSA-rhwp-9vm9-547q published
- 2021-04-18: other: CVE-2021-23377 published in NVD