Executive brief
smartctl is a Node.js library that wraps the smartctl hard drive diagnostics tool. The library fails to properly validate user-supplied device paths before passing them to system commands, allowing attackers to inject arbitrary shell commands that execute with the privileges of the application running the library.
Technical details
The vulnerability is a command injection flaw (CWE-77/CWE-78) in the info() method due to improper input sanitization of the devicePath parameter. The vulnerable code directly concatenates user-controlled input into a shell command string executed via child_process.exec() without escaping or validation. An attacker who can control the devicePath argument can inject shell metacharacters to execute arbitrary commands. The vulnerability affects all versions of the smartctl npm package through version 1.0.0. No authentication or special privileges are required beyond the ability to call the affected methods.
Affected products
- <UNKNOWN> smartctl all versions through 1.0.0
Timeline
- 2023-01-26: disclosed
- 2023-01-27: advisory: GitHub reviewed and confirmed