Executive brief
ssl-utils is a Node.js library that wraps OpenSSL commands for managing SSL certificates. The library fails to sanitize user input passed to the createCertRequest() and createCert() functions, allowing attackers to inject arbitrary shell commands. An attacker who can control certificate generation parameters could execute arbitrary code on the system running the application.
Technical details
The ssl-utils library wraps OpenSSL commands for SSL certificate operations but fails to properly sanitize user-supplied input before passing it to shell execution contexts. The vulnerability exists in the createCertRequest() and createCert() functions, which accept user-controlled certificate parameters (subject, CN, O, OU, etc.) and incorporate them into OpenSSL command invocations without escaping shell metacharacters (CWE-78). An attacker with the ability to influence certificate generation parameters could inject shell metacharacters to execute arbitrary commands with the privileges of the application process. The vulnerability requires the application to call the affected functions with attacker-controlled input; it is not remotely exploitable by default but affects any application using ssl-utils for certificate generation. No patch information is currently available; the recommended mitigation is to upgrade to a patched version if released or to avoid using this library for untrusted certificate generation operations.
Affected products
- es128 ssl-utils <=1.0.0
Timeline
- 2022-06-02: disclosed: NVD published
- 2022-06-03: advisory: GitHub advisory GHSA-552j-pv39-f3jf published