Executive brief
node-twain is a Node.js library that provides access to TWAIN image scanning devices. The library fails to validate the length of user-supplied input when initializing the TwainSDK object, allowing strings of 34 characters or longer to overflow fixed-size buffers. An attacker providing malicious configuration parameters could crash the application or potentially execute arbitrary code.
Technical details
The vulnerability is a classic buffer overflow (CWE-703 / CWE-120) in the native C++ component. The library uses strcpy() without bounds checking to copy user-provided strings (productName, productFamily, manufacturer, version.info) into fixed 34-byte TW_STR32 character arrays. Since strcpy() copies until a null terminator is encountered, any input string of 34 characters or longer will overflow the buffer. The vulnerability requires instantiation of a TwainSDK object with attacker-controlled configuration parameters (no authentication required). Successful exploitation can lead to heap corruption, denial of service (crash), or potentially arbitrary code execution. All versions up to 0.0.16 are affected, and no patch is currently available.
Affected products
- Luomusha node-twain all versions up to 0.0.16
Timeline
- 2024-01-15: disclosed: Vulnerability details published on GitHub gist
- 2024-07-10: advisory: CVE-2024-21525 and GHSA-wxr3-2hgv-qm8f published