Executive brief
samsung-remote is a Node.js library for controlling Samsung devices remotely. Versions before 1.3.5 contain a command injection vulnerability that allows attackers to execute arbitrary commands on a system if user input is passed to the ip option of the package. An attacker could use this flaw to gain complete control over a system running the vulnerable library.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the samsung-remote npm package prior to version 1.3.5. The vulnerability occurs when user-controlled input is passed to the ip option of the package constructor without proper sanitization, allowing an attacker to inject shell commands that will be executed with the privileges of the application. The attack vector is network-based and does not require authentication or user interaction. Successful exploitation allows remote code execution. The fix is available in version 1.3.5 and later.
Affected products
- npm samsung-remote < 1.3.5
Timeline
- 2020-09-01: disclosed