Executive brief
pi_video_recording is a Node.js library for video recording functionality. The library fails to properly validate user input on its API endpoint, allowing attackers to inject and execute arbitrary commands on the server. This could lead to complete compromise of the system running the library, including data theft, service disruption, or use as a pivot point for further attacks.
Technical details
The vulnerability is a command injection flaw (CWE-20: improper input validation) in the /api/record/start endpoint. The server constructs and executes system commands using unsanitized user-supplied input from the "filename" parameter without proper escaping or validation. An unauthenticated attacker with network access to the API endpoint can inject shell metacharacters (e.g., "||", ";", "&") to execute arbitrary commands with the privileges of the server process. A proof-of-concept demonstrates file creation via injected shell operators. No patch has been released; the advisory recommends using alternative modules.
Affected products
- npm pi_video_recording all versions
Timeline
- 2020-09-02: disclosed