Executive brief
wincred is a Node.js library used to access Windows credential storage. The library fails to sanitize user input passed to the getCredential function, allowing an attacker to inject and execute arbitrary system commands. This could enable complete system compromise including data theft, malware installation, or service disruption.
Technical details
This is a command injection vulnerability (CWE-20) affecting all versions of the wincred npm package. The root cause is the use of Node.js child_process.exec() without input sanitization in the getCredential function. An attacker can pass malicious input that includes shell metacharacters to execute arbitrary commands with the privileges of the Node.js process. The vulnerability requires network reachability to the application using wincred but no prior authentication or user interaction. The attack allows arbitrary command execution, leading to full system compromise. No patch has been released as of the advisory publication date (June 2021).
Affected products
- npm wincred all versions up to and including 1.0.2
Timeline
- 2021-06-29: disclosed
- 2021-06-28: advisory