Executive brief
vagrant.js is a Node.js library that wraps the Vagrant virtualization tool. The library fails to properly validate user input in its boxAdd function, allowing attackers to inject arbitrary shell commands that will be executed on the system. This could allow an attacker to execute malicious code, steal data, or compromise systems that use this library.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in the boxAdd function of vagrant.js. The function constructs shell commands using unsanitized user-supplied parameters (boxName and boxUrl), allowing an attacker to break out of the intended command context and inject arbitrary shell metacharacters and commands. The proof-of-concept demonstrates exploitation via a crafted boxName parameter: vagrant.boxAdd(";touch EXPLOITED;#", "", callback). The attack requires local or programmatic access to call the vulnerable function; no authentication is required. An attacker can achieve arbitrary code execution with the privileges of the Node.js process. All versions through 0.0.4 are vulnerable, and no patch is available as of the advisory date.
Affected products
- cakecatz vagrant.js all versions <= 0.0.4
Timeline
- 2023-01-26: disclosed: GHSA and CVE published
- 2022-12-19: exploited: Vulnerability reported to Snyk