Executive brief
The entitlements npm package is used to manage system permissions and capabilities in Node.js applications. Versions prior to 1.3.0 fail to validate user input before passing it to system commands, allowing attackers to inject arbitrary shell commands and execute code with the privileges of the running process.
Technical details
This is a command injection vulnerability (CWE-77) in the entitlements function. The root cause is insufficient input validation and unsafe concatenation of user-supplied input into an exec() call. The attack requires the attacker to control input passed to the vulnerable entitlements function, after which arbitrary shell commands can be executed in the context of the Node.js process. An attacker can achieve remote code execution or privilege escalation depending on the application's privileges. The vulnerability was fixed in version 1.3.0.
Affected products
- npm entitlements prior to 1.3.0
Timeline
- 2020-09-11: disclosed
- 2020: patched: version 1.3.0 released