Executive brief
n158 is a Node.js utility for setting up and managing HTTP servers and daemons. The package fails to properly sanitize user input in its initialization function, allowing attackers with local access to inject arbitrary shell commands that execute with the privileges of the Node.js process. This can lead to unauthorized file modification, data theft, or complete system compromise.
Technical details
The vulnerability is a classic command injection flaw (CWE-78) in the initProject.js file where user-supplied input (specifically the --name parameter) is concatenated directly into shell command strings without sanitization or escaping. The vulnerable code passes the targetPath variable directly into shell.exec() calls like `shell.exec('sh -c \'cd '+targetPath+' && npm install\'')`, allowing an attacker to inject shell metacharacters. Attack precondition: the attacker must have the ability to execute Node.js code or invoke the n158 CLI command locally on the target system. PoC: `n158 init --name ".';touch EXPLOITED;#"` demonstrates arbitrary command execution. An attacker achieving code execution can read sensitive files, modify application code, install backdoors, or escalate privileges. All versions of n158 are affected; no patched version has been released.
Affected products
- dsilva2401 n158 All versions up to 1.4.1
Timeline
- 2023-05-27: disclosed
- 2023-05-30: advisory: GitHub security advisory review completed