Executive brief
Saltcorn is a low-code web application builder that allows administrators to extend functionality by installing plugins from external sources. An administrator can inject arbitrary shell commands via the plugin name field when creating a git-based plugin, enabling remote code execution with the privileges of the Saltcorn application server. This could lead to full compromise of the application and underlying system.
Technical details
The vulnerability is an OS command injection (CWE-78) in the @saltcorn/plugins-loader package. When an administrator creates a new plugin using a git source, the unsanitized plugin name from req.body.name is passed through the Plugin class constructor and used to build a file path for git clone operations. The PluginInstaller class splits the plugin name and passes it to the gitPullOrClone function, which constructs a shell command passed to child_process.execSync without sanitization. An attacker with admin privileges can include shell metacharacters (e.g., semicolons, backticks) in the plugin name to break out of the intended command and execute arbitrary commands. The attack requires high privilege level (admin), but no user interaction, over a network vector. The vulnerability was patched in version 1.0.0-beta.14 by sanitizing the pluginDir value before passing it to execSync.
Affected products
- Saltcorn plugins-loader <=1.0.0-beta.13
Timeline
- 2024-10-03: disclosed: Published as GHSA-fm76-w8jw-xf8m
- 2024-10-03: patched: Fix available in version 1.0.0-beta.14