Executive brief
moment-timezone is a JavaScript library that provides timezone support. Developers who build custom versions of moment-timezone using Grunt build tasks are at risk if they allow third parties to specify which timezone data version to download and compile. An attacker can inject shell commands into the version parameter, gaining arbitrary code execution on the build machine with the privileges of the build process.
Technical details
The vulnerability exists in three Grunt build task files: tasks/data-download.js, tasks/data-zic.js, and tasks/data-zdump.js. These tasks use Node.js's exec() function to execute shell commands, concatenating unsanitized user input (the version parameter) directly into the command string. For example, the data-download task constructs a curl command like: exec('curl ' + src + ' -o ' + curl + ' && cd ' + dest + ' && gzip -dc ' + curl + ' | tar -xf -'). An attacker providing a version like "2014d ; echo flag>/tmp/foo #" can inject arbitrary shell commands. The data-zdump.js task has an additional attack vector through file metadata in temporary directories. The fix, applied in version 0.5.35, replaces exec() with execFile(), which treats arguments as an array rather than a shell string, preventing injection.
Affected products
- moment moment-timezone 0.1.0 through 0.5.34
Timeline
- 2022-08-30: disclosed: GHSA-56x4-j7p9-fcf9 published
- 2022-08-23: patched: Fix committed (ce955a3) switching from exec to execFile