Executive brief
abacus-ext-cmdline is a Node.js library for executing shell commands. A command injection vulnerability in its execute function allows attackers to inject and run arbitrary shell commands by bypassing input sanitization. Exploitation requires local access to the application but can result in complete compromise of the affected system.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in the execute function caused by insufficient sanitization of user-supplied input before passing it to shell execution. An attacker can inject shell metacharacters (e.g., `&`, `|`, `;`) into command parameters to break out of the intended command and execute arbitrary system commands. The attack vector is local with high attack complexity, as an attacker must have some ability to influence the input passed to the vulnerable function. Proof-of-concept code demonstrates command injection via the syntax: `root.execute('"&touch JHU&"')`. No patched version has been released; all versions remain vulnerable.
Affected products
- abacus-ext-cmdline abacus-ext-cmdline all versions
Timeline
- 2022-12-06: disclosed
- 2022-12-21: advisory