Executive brief
mobile-icon-resizer is a Node.js library that resizes images for use as iOS and Android application icons. The library contains a code execution vulnerability where user-supplied configuration parameters are directly passed to JavaScript's eval() function, allowing attackers to execute arbitrary code during the icon resizing process. An attacker who controls the configuration file can run malicious scripts with the privileges of the application using this library.
Technical details
The vulnerability is a classic code injection flaw (CWE-94) in mobile-icon-resizer versions 0.2.0 through 0.4.2. The library's getSizeFromRatio() function in lib/resize.js directly passes the 'ratio' and 'baseRatio' configuration parameters to eval(), which interprets them as executable JavaScript code. An attacker can craft a malicious configuration file with JavaScript payloads in these fields to achieve arbitrary code execution. The vulnerability requires the attacker to control or manipulate the configuration file passed to the resize() function, but no authentication or network exploitation is required. The fix, available in version 0.4.3 and later, replaces the eval() call with safe mathematical parsing.
Affected products
- mobile-icon-resizer mobile-icon-resizer 0.2.0 through 0.4.2
Timeline
- 2016-04-08: disclosed: Vulnerability reported as issue on GitHub
- 2019-06-27: patched: Advisory published; fix available in version 0.4.3
- 2019-06-27: advisory: GHSA-mxjr-xmcg-fg7w published