Executive brief
priest-runner is a Node.js package that handles child process spawning for application workflows. The package fails to sanitize user input from HTTP POST requests before passing it directly to the spawn function, allowing attackers to execute arbitrary system commands. An attacker can inject commands through API requests to run malicious code on the host system.
Technical details
This is a command injection vulnerability (CWE-77) in the PriestController.prototype.createChild function. The vulnerability occurs because spawn parameters are taken directly from POST request body data without input validation or sanitization. An attacker with network access to the application can craft malicious POST requests containing shell metacharacters or command chains to execute arbitrary code on the server. The attack requires network reachability to the affected application but no authentication. No patch has been made available as of the advisory publication date.
Affected products
- npm priest-runner all versions
Timeline
- 2020-09-03: disclosed