Executive brief
The samba-client Node.js package provides a client interface for accessing Samba network file shares. Versions before 4.0.0 use an unsafe shell execution method that allows attackers to inject arbitrary operating system commands, potentially leading to complete system compromise including data theft and service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the samba-client Node.js package before version 4.0.0, caused by unsafe use of process.exec() without proper input sanitization (CWE-74, CWE-77). An attacker who can control input passed to the samba-client API can inject shell metacharacters to execute arbitrary commands on the system running the application. No authentication or special privileges are required from the attacker; the attack requires only network-level access to the application or local ability to influence function arguments. Exploitation allows arbitrary command execution with the privileges of the Node.js process. The vulnerability was patched in version 4.0.0 by replacing process.exec() with safer alternatives.
Affected products
- eflexsystems samba-client before 4.0.0
Timeline
- 2021-02-10: disclosed
- 2021-02-09: patched: Version 4.0.0 released