Executive brief
is-http2 is a Node.js library used to check if a web server supports the HTTP/2 protocol. A security vulnerability in this library allows an attacker to execute unauthorized commands on the underlying system. This could lead to a full system takeover, data theft, or disruption of services if the library processes untrusted input.
Technical details
All versions of the npm package is-http2 are vulnerable to OS command injection. The root cause is the improper sanitization of the 'openssl' option and 'url' parameters passed to the isH2 function, which are subsequently used in a child_process.exec() call. An attacker who can control these inputs can inject arbitrary shell commands that execute with the privileges of the Node.js process. While the attack vector is classified as local, it poses a significant risk in environments where the library is used to process user-supplied configuration or URLs. As of the latest advisory, there is no known patch available.
Affected products
- stefanjudis is-http2 All versions up to and including 1.2.0
Timeline
- 2022-12-05: disclosed: Vulnerability disclosed by JHU System Security Lab
- 2023-02-01: advisory: NVD and GitHub Advisory Database published the vulnerability