Executive brief
The dns-sync npm module is a Node.js DNS resolution utility. Versions before 0.1.1 contain a command injection vulnerability in the resolve API function that allows attackers to execute arbitrary system commands by injecting shell metacharacters into DNS resolution requests.
Technical details
The dns-sync module before 0.1.1 is vulnerable to command injection due to unsafe handling of shell metacharacters in the first argument to the resolve API function. An attacker can craft malicious input containing shell metacharacters to execute arbitrary commands on the affected system. The vulnerability requires the attacker to be able to control input passed to the resolve function. A patch was released in version 0.1.1 that properly sanitizes or escapes shell metacharacters.
Affected products
- dns-sync dns-sync before 0.1.1
Timeline
- 2018-07-26: disclosed
- 0.1.1: patched
- 2020-06-17: other: advisory withdrawn as accidental duplicate publish