Executive brief
ShellJS is a popular Node.js library that provides Unix shell commands for cross-platform scripting. The library's exec() function, used to run system commands, creates temporary files with insufficient permission restrictions. A local attacker with access to the system could potentially read sensitive data from these temporary files or interfere with command execution, compromising the confidentiality and integrity of operations that rely on ShellJS.
Technical details
ShellJS is vulnerable to CWE-269 (Improper Privilege Management) in the internal implementation of the shell.exec() function. The vulnerability stems from temporary files created during command execution being initialized with overly permissive file permissions, making them readable or writable by other local users. An attacker with local system access can exploit this to read sensitive information from temporary files or modify them to interfere with command execution. The attack vector is local with low privilege requirements (non-root users can exploit this). A fix was released in version 0.8.5 which locks down file permissions used by the exec() implementation, as documented in commit d919d22dd6de385edaa9d90313075a77f74b338c.
Affected products
- ShellJS ShellJS before 0.8.5
Timeline
- 2022-01-11: disclosed: Published on NVD
- 2022-01-21: advisory: GHSA-4rq4-32rv-6wp6 published
- 2022-01-21: patched: Fixed in version 0.8.5