Executive brief
chromedriver is a Node.js library used to control Google Chrome for web testing and automation. The library is vulnerable to command injection when an application allows untrusted input to configure the chromedriver.path setting. An attacker with local system access could exploit this to execute arbitrary commands with the privileges of the process running chromedriver.
Technical details
This is a command injection vulnerability (CWE-78) in the chromedriver Node.js package affecting versions before 119.0.1. The root cause is improper validation of the chromedriver.path configuration parameter, which can be set to an arbitrary system binary. When chromedriver attempts to execute this path without proper sanitization, an attacker who can control or influence this setting can inject shell metacharacters to execute arbitrary commands. The attack requires local system access and the ability to either modify the chromedriver.path configuration or influence the application's code path that sets it. The vulnerability was fixed by version 119.0.1, which restricts the exportable attributes to prevent exposure of private/sensitive configuration properties.
Affected products
- node-chromedriver chromedriver before 119.0.1
Timeline
- 2023-11-09: disclosed
- 2023-11-07: patched: Fix committed on November 7, 2023