Executive brief
require-node is a Node.js library that exposes a remote require endpoint for loading code dynamically. Versions prior to 1.3.4 (1.x) and 2.0.4 (2.x) fail to properly validate requests, allowing attackers to inject operating system commands that execute with the privileges of the server running the library. This enables complete server compromise and arbitrary code execution.
Technical details
The vulnerability is a command injection flaw (CWE-78) in require-node's endpoint handling. The library fails to sanitize user-supplied input in the request body before passing it to OS command execution, allowing attackers to inject shell metacharacters and arbitrary commands. The attack vector is network-based and requires only network access to the require-node endpoint (typically no authentication). An attacker can achieve remote code execution on the server with the privileges of the Node.js process. Patches are available: upgrade to version 1.3.4 or later for the 1.x branch, or version 2.0.4 or later for the 2.x branch.
Affected products
- npm require-node < 1.3.4 (1.x), 2.0.0 - 2.0.3 (2.x)
Timeline
- 2020-09-03: disclosed
- 2020-08-31: patched: Patches released for 1.3.4 and 2.0.4