Executive brief
s3-uploader is a Node.js library used to upload files to Amazon S3 cloud storage. An OS command injection vulnerability in the metadata() function allows attackers to execute arbitrary system commands on servers using this library, potentially leading to complete system compromise and data theft.
Technical details
This is a classic OS command injection vulnerability (CWE-78) in the metadata() function of s3-uploader through version 2.0.3. The vulnerability exists because user-controlled input is passed unsanitized to system command execution. An attacker can exploit this by providing malicious input to the metadata() function to break out of the intended command context and execute arbitrary shell commands. The attack requires the application to call the vulnerable metadata() function with attacker-controlled data. Patches are available in versions after 2.0.3.
Affected products
- Turistforeningen s3-uploader through 2.0.3
Timeline
- 2022-06-02: disclosed
- 2022-06-03: advisory