Executive brief
wifey is a Node.js package for WiFi connectivity management. The package is vulnerable to command injection through the connect() function due to improper input sanitization, allowing attackers to execute arbitrary commands on systems running affected versions.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in the connect() function caused by improper sanitization of user-supplied input, particularly the SSID parameter. An attacker can inject shell metacharacters (e.g., semicolons, redirects) into the function arguments to execute arbitrary commands. The vulnerability is local in nature and requires no authentication or user interaction—an attacker with the ability to call the connect() function can exploit it. Proof-of-concept code demonstrates execution of arbitrary commands via malicious SSID values. No fixed version has been released for this package.
Affected products
- wifey wifey all versions up to and including 2.0.7
Timeline
- 2022-12-19: disclosed
- 2023-01-09: advisory