Executive brief
Google-it is a Node.js package that allows applications to send search queries to Google and retrieve results. When the 'Open in browser' feature is used, unsanitized search result links are concatenated into shell commands, allowing attackers to execute arbitrary code on the server. An attacker can exploit this to achieve remote code execution if the application uses this feature.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the 'Open in browser' feature of google-it versions up to 1.6.2. The vulnerable code unsafely concatenates Google search result URLs directly into shell commands without proper escaping or sanitization. Attack requires network access to send a malicious search query; no authentication is required. An attacker can craft a search result link containing shell metacharacters to break out of the intended command and execute arbitrary system commands with the privileges of the Node.js process. Fix/patch availability was available at the time of CVE publication.
Affected products
- google-it google-it up to 1.6.2
Timeline
- 2022-06-03: disclosed
- 2021: other: CVE-2021-34083 assigned