Executive brief
nemo-appium is a Node.js library that integrates Appium (a mobile automation framework) into PayPal's testing infrastructure. The library fails to properly sanitize user input passed to the module.exports.setup function, allowing attackers to inject arbitrary operating system commands. An attacker who can control the input to this function can execute arbitrary code on the system running the library, potentially compromising the entire test environment and any data accessible from it.
Technical details
This is a classic OS command injection vulnerability (CWE-77, CWE-78) in the module.exports.setup function caused by improper input sanitization. The attack vector is network-accessible when the vulnerable application is exposed, with no authentication required and no user interaction needed. An attacker can inject shell metacharacters into the setup function's input parameters, which are then executed directly by the operating system. Exploitation requires nemo-appium version below 0.0.9 and depends on appium-running 0.1.3 being installed as a dependency. The vulnerability was patched in version 0.0.9 via commit aa271d36dd5c81baae3c43aa2616c84f0ee4195f.
Affected products
- PayPal nemo-appium before 0.0.9
Timeline
- 2023-01-31: disclosed
- 2023-01-31: patched: Fixed in version 0.0.9
- 2023-01-31: advisory: Published as GHSA-c6rx-gxqv-vr5j