Executive brief
The macaddress npm library is used to retrieve MAC addresses on local systems. A command injection vulnerability in this library allows an attacker to execute arbitrary commands on the system if they can influence the input passed to the library, potentially compromising system integrity and confidentiality.
Technical details
The macaddress npm library contains a command injection vulnerability that occurs when user-controlled input is not properly sanitized before being passed to shell commands. An attacker who can control input to the vulnerable functions can inject arbitrary shell commands that will be executed with the privileges of the Node.js process. The vulnerability affects all versions prior to 0.2.9, which contains the fix. Exploitation requires the ability to provide input to the macaddress library functions, typically through an application that uses this library without proper input validation.
Affected products
- npm macaddress before 0.2.9
Timeline
- 2020-08-19: disclosed