Executive brief
exec-local-bin is a Node.js library that executes shell commands. Versions before 1.2.0 fail to properly validate user input passed to the theProcess() function, allowing attackers to inject arbitrary shell commands and execute them with the privileges of the application.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in the theProcess() function caused by improper user-input sanitization. An attacker can craft malicious input containing shell metacharacters to break out of the intended command and execute arbitrary code. The vulnerability is network-reachable if the affected application exposes this functionality via an API or web interface, and requires no authentication if the endpoint is accessible. Successful exploitation allows remote code execution with the privileges of the Node.js process. The fix was released in version 1.2.0.
Affected products
- exec-local-bin exec-local-bin before 1.2.0
Timeline
- 2023-01-06: disclosed
- 2023-01-06: patched: Version 1.2.0 released with fix