Executive brief
local-devices is a Node.js library for discovering and managing local network devices. Versions before 3.0.0 allow attackers to execute arbitrary system commands by injecting shell metacharacters into IP address parameters, potentially leading to system compromise or data theft.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the find() API function. The library fails to validate or sanitize IP address input before concatenating it directly into a shell exec() call, allowing an attacker to inject arbitrary shell commands via pipe operators or other shell metacharacters (e.g., '127.0.0.1 | mkdir attacker'). No authentication is required; an attacker only needs to call the vulnerable find() function with malicious input. The fix, released in version 3.0.0, validates IP addresses before executing the system command.
Affected products
- npm local-devices prior to 3.0.0
Timeline
- 2020-09-03: disclosed
- 2019-10-24: patched: Fix merged in PR #16