Executive brief
Config-shield is a Node.js configuration management package used to protect sensitive settings in applications. The package unsafely uses the eval function to process configuration commands, allowing an attacker to inject and execute arbitrary code if they can control the input to the set command. This could lead to complete compromise of the application and any data it protects.
Technical details
The vulnerability exists in scripts/cli.js where the set command processes user-supplied input using eval, a dangerous function that interprets strings as executable code (CWE-913: Improper Control of Dynamically-Managed Code Resources). An attacker who can control input to the set command can inject malicious JavaScript code that will be executed in the context of the Node.js process. The fix, implemented in version 0.2.3, replaces eval with safe JSON5.parse, which parses only data structures without executing code. While the vendor noted the set command was not intended for untrusted data, the use of eval is inherently unsafe and the fix was applied.
Affected products
- GoDaddy config-shield before 0.2.3
Timeline
- 2021-01-27: disclosed: CVE published on NVD
- 2021-04-13: advisory: GHSA advisory published
- 2021-04-13: patched: Fix available in version 0.2.3