Executive brief
node-wifi is a Node.js library for interacting with WiFi networks on the system. Versions prior to 2.0.12 contain a command injection vulnerability where user input passed to the SSID parameter is not properly sanitized, allowing an attacker to inject arbitrary shell commands and achieve remote code execution with the privileges of the application.
Technical details
The vulnerability is a classic command injection (CWE-77) affecting node-wifi prior to version 2.0.12. The root cause is the failure to properly sanitize or escape user-supplied input, specifically the SSID variable, before passing it to shell command execution. An attacker can inject arbitrary shell commands through the SSID parameter to achieve remote code execution on the system running the vulnerable application. The attack vector is local or network-accessible depending on how the application exposes the node-wifi functionality, and typically requires the application to process attacker-controlled SSID input. A fix is available in version 2.0.12 and later.
Affected products
- node-wifi node-wifi <2.0.12
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Fix available in version 2.0.12