Executive brief
lifion-verify-deps is a Node.js package that scans project dependencies listed in package.json files. An attacker can craft malicious dependency names in a package.json file that, when scanned by this tool, trigger arbitrary OS command execution on the developer's system. This could allow code execution and compromise of development environments.
Technical details
The vulnerability is a classic OS command injection (CWE-78) that exists through version 1.1.0. The vulnerable component fails to properly sanitize or validate dependency names read from package.json before passing them to shell execution. An attacker can inject shell metacharacters or command separators within a crafted dependency name in a malicious package.json file. When the tool scans this file, the unsanitized input is executed as an OS command, allowing arbitrary code execution. The attack requires that a developer runs the tool on a project containing the malicious package.json (user interaction). The vulnerability was fixed in version 1.2.0 by adding proper validation for npm module names.
Affected products
- lifion lifion-verify-deps through 1.1.0
Timeline
- 2022-06-02: disclosed
- 2022-06-03: patched: Fixed in version 1.2.0 with npm module name validation