Junglewise Threat Intelligence

dns-sync command injection in resolve function

Severity: info · Published 2018-07-26

Technologies: dns-sync (npm). Vendors: npm.

Executive brief

The dns-sync npm module is a Node.js DNS resolution utility. Versions before 0.1.1 contain a command injection vulnerability in the resolve API function that allows attackers to execute arbitrary system commands by injecting shell metacharacters into DNS resolution requests.

Technical details

The dns-sync module before 0.1.1 is vulnerable to command injection due to unsafe handling of shell metacharacters in the first argument to the resolve API function. An attacker can craft malicious input containing shell metacharacters to execute arbitrary commands on the affected system. The vulnerability requires the attacker to be able to control input passed to the resolve function. A patch was released in version 0.1.1 that properly sanitizes or escapes shell metacharacters.

Affected products

  • dns-sync dns-sync before 0.1.1

Timeline

  • 2018-07-26: disclosed
  • 0.1.1: patched
  • 2020-06-17: other: advisory withdrawn as accidental duplicate publish

Related threats