Executive brief
@acrontum/filesystem-template is a Node.js library for managing filesystem templates and repositories. A command injection vulnerability in the fetchRepo API allows unauthenticated attackers to execute arbitrary system commands by passing unsanitized URL parameters. An attacker can achieve remote code execution on systems using affected versions of this library.
Technical details
The fetchRepo API fails to sanitize the href parameter before passing it to shell command execution. The vulnerability is a classic command injection (CWE-77) where shell metacharacters (such as pipes) in the href field allow injecting additional commands. The attack is network-accessible, requires no authentication or user interaction, and affects all versions before 0.0.2. An attacker can achieve arbitrary command execution with the privileges of the Node.js process. A fix was released in version 0.0.2.
Affected products
- Acrontum @acrontum/filesystem-template before 0.0.2
Timeline
- 2022-03-16: disclosed: Issue reported on GitHub
- 2022-08-05: patched: Fix released in version 0.0.2
- 2022-08-06: advisory: GHSA-m2fc-9h5m-29cm published