Executive brief
react-dev-utils is a utility library used by Create React App to help developers set up and manage React applications. A command injection vulnerability in the getProcessForPort function could allow an attacker to execute arbitrary system commands if the library is used with untrusted input outside of Create React App's normal usage. This could lead to unauthorized code execution and compromise of the developer's machine or build environment.
Technical details
The getProcessForPort function in react-dev-utils concatenates user-supplied input directly into a command string executed via child_process.execSync(), allowing OS command injection (CWE-78). The vulnerability requires direct invocation of getProcessForPort with attacker-controlled port or process identification values; normal usage through react-scripts does not expose this risk because react-scripts provides safe inputs. An attacker able to influence code that calls getProcessForPort can inject shell metacharacters to execute arbitrary commands with the privileges of the Node.js process. The fix replaces execSync() with execFileSync(), which does not interpret shell metacharacters and provides argument array separation, preventing command injection. A patch is available in react-dev-utils v11.0.4 and later.
Affected products
- Facebook react-dev-utils 0.4.0 to 11.0.3
Timeline
- 2021-03-11: disclosed: GHSA-5q6m-3h65-w53x published
- 2021-03-08: patched: Security fix merged as PR #10644
References
- https://github.com/facebook/create-react-app/pull/10644
- https://github.com/facebook/create-react-app/commit/f5e415f3a5b66f07dcc60aba1b445fa7cda97268
- https://github.com/facebook/create-react-app
- https://www.facebook.com/security/advisories/cve-2021-24033
- https://www.huntr.dev/bounties/1-npm-react-dev-utils