Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 3 October 2024.

Which products and versions are affected?

@saltcorn/plugins-loader (npm) SEMVER:introduced=0,fixed=1.0.0-beta.14; Saltcorn Plugins-Loader <=1.0.0-beta.13.

Is there a fix for This vulnerability?

Yes. @saltcorn/plugins-loader (npm): upgrade to 1.0.0-beta.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @saltcorn/plugins-loader (npm) or Saltcorn Plugins-Loader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Saltcorn plugins-loader command injection in git plugin installation

Q: Is there a fix for This vulnerability?

Yes. @saltcorn/plugins-loader (npm): upgrade to 1.0.0-beta.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run @saltcorn/plugins-loader (npm) or Saltcorn Plugins-Loader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 3.1 · Published 2024-10-03

Saltcorn is a low-code web application builder that allows administrators to extend functionality by installing plugins from external sources. An administrator can inject arbitrary shell commands via the plugin name field when creating a git-based plugin, enabling remote code execution with the privileges of the Saltcorn application server. This could lead to full compromise of the application and underlying system.

Vendors: npm, Saltcorn.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 3 October 2024.
Which products and versions are affected?: @saltcorn/plugins-loader (npm) SEMVER:introduced=0,fixed=1.0.0-beta.14; Saltcorn Plugins-Loader <=1.0.0-beta.13.
Is there a fix for This vulnerability?: Yes. @saltcorn/plugins-loader (npm): upgrade to 1.0.0-beta.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @saltcorn/plugins-loader (npm) or Saltcorn Plugins-Loader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@saltcorn/plugins-loader (npm): upgrade to 1.0.0-beta.14 or later
```
npm install @saltcorn/plugins-loader@1.0.0-beta.14
```

Technical details

The vulnerability is an OS command injection (CWE-78) in the @saltcorn/plugins-loader package. When an administrator creates a new plugin using a git source, the unsanitized plugin name from req.body.name is passed through the Plugin class constructor and used to build a file path for git clone operations. The PluginInstaller class splits the plugin name and passes it to the gitPullOrClone function, which constructs a shell command passed to child_process.execSync without sanitization. An attacker with admin privileges can include shell metacharacters (e.g., semicolons, backticks) in the plugin name to break out of the intended command and execute arbitrary commands. The attack requires high privilege level (admin), but no user interaction, over a network vector. The vulnerability was patched in version 1.0.0-beta.14 by sanitizing the pluginDir value before passing it to execSync.

Affected products

Saltcorn plugins-loader <=1.0.0-beta.13

Timeline

2024-10-03: disclosed: Published as GHSA-fm76-w8jw-xf8m
2024-10-03: patched: Fix available in version 1.0.0-beta.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.