Executive brief
fs-path is a Node.js library for file system path manipulation. The library fails to properly sanitize user input, allowing attackers to inject arbitrary shell commands that execute with the privileges of the application using the library. This can lead to complete compromise of the system running the affected application.
Technical details
The vulnerability is a command injection flaw (CWE-77) affecting all versions of the fs-path npm module. The library fails to sanitize unsanitized user input before passing it to shell operations, allowing attackers to inject arbitrary commands. The attack requires the application to pass user-controlled input to vulnerable fs-path functions without validation. Successful exploitation grants the attacker the ability to execute arbitrary shell commands in the context of the running process. A fix was released in version 0.0.25, though the advisory initially recommended against using the module until a patch became available.
Affected products
- fs-path fs-path < 0.0.25
Timeline
- 2019-06-12: disclosed