Executive brief
bwm-ng is a Node.js library for bandwidth monitoring that provides network interface data collection. The package contains a command injection vulnerability in its check function that allows attackers with Node.js code execution access to run arbitrary system commands, potentially compromising system confidentiality, integrity, and availability.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the 'check' function within bwm-ng.js, caused by improper input sanitization of interface names passed as function parameters. An attacker who can invoke the check() function with malicious input can execute arbitrary shell commands on the system. The attack requires local access to run Node.js code within the target application environment—the attacker must have the ability to execute JavaScript code within the application context. All versions up to and including 0.1.1 are vulnerable, with no fixed version currently available.
Affected products
- bwm-ng bwm-ng 0 to 0.1.1
Timeline
- 2022-12-20: disclosed
- 2023-05-27: advisory
- other: CVE-2023-26129 assigned