Executive brief
expressfs is a Node.js library for file system operations. The package fails to validate user input across multiple API endpoints (appendFile, cp, create, rmdir), allowing attackers to execute arbitrary system commands on servers or systems using the library. This can lead to complete system compromise, data theft, or service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the expressfs package affecting all versions. The vulnerable endpoints—appendFile, cp, create, and rmdir—do not properly sanitize or validate user-supplied input before passing it to system command execution. An attacker can inject arbitrary shell commands through API parameters if the application exposes these endpoints to untrusted input (e.g., via HTTP requests). Successful exploitation allows remote code execution with the privileges of the process running the library. No patch is currently available; the maintainers recommend using an alternative module.
Affected products
- expressfs all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory