Executive brief
The openssl npm package is a wrapper around the OpenSSL command-line tool. A vulnerability allows attackers to inject arbitrary operating system commands through the package's verb parameter, potentially leading to complete system compromise. This vulnerability affects all versions up to 2.0.0, but the package is no longer maintained.
Technical details
The npm openssl package (node-openssl) contains a command injection vulnerability in its core function, which accepts an opts object with a verb field that is directly interpolated into a shell command passed to child_process.exec() without sanitization. The vulnerable code constructs a command string like "openssl {verb} {flags} {tail}" and executes it with exec(), which spawns a shell and allows shell metacharacter injection. An attacker can inject arbitrary shell commands (e.g., "| touch exploited.txt") through the verb parameter to execute code with the privileges of the Node.js process. No authentication is required—any code that calls this package with untrusted input is vulnerable. The package is no longer maintained, and no patch is available.
Affected products
- npm openssl through 2.0.0
Timeline
- 2023-11-23: disclosed
- 2023-11-27: advisory