Executive brief
broccoli-compass is a Sass-Compass plugin for the Broccoli build system used by Node.js developers. An attacker who can control filenames passed to the plugin can inject and execute arbitrary system commands, potentially compromising the build environment and any machine running the affected code.
Technical details
The vulnerability is an arbitrary command injection (CWE-77) in broccoli-compass v0.2.4 and earlier, caused by unsanitized use of Node.js child_process.exec() when processing the "files" option. An attacker-controlled filename containing shell metacharacters and command substitution syntax (e.g., $(touch success);#) is passed directly to exec() without sanitization. No authentication or special privileges are required; the vulnerability is triggered when user-influenced filenames reach the files parameter. A successful exploit results in arbitrary command execution with the privileges of the Node.js process. There is no evidence of a patch in the advisory; affected versions should not be used.
Affected products
- npm broccoli-compass 0.2.4 and earlier
Timeline
- 2023-04-24: disclosed
- 2023-04-24: advisory: GHSA-wq8f-xmq3-5vq9 published