Executive brief
ShellJS is a Node.js library that provides portable Unix shell commands. The synchronous version of the shell.exec() function improperly manages file permissions when writing output, allowing other users on the same system to read sensitive command output. This affects multi-user systems like shared Linux servers and macOS machines, or when the application runs with root privileges.
Technical details
The vulnerability is an improper privilege management issue (CWE-269) in the synchronous shell.exec() function. The root cause is that temporary output files are created with insufficient access restrictions, making command output readable by other users on the same system. The vulnerability is triggered whenever shell.exec() is used in multi-user environments (Mac, Linux, WSL) or when running as root. An attacker with local access can read sensitive information from temporary files, including credentials, API keys, or other confidential data passed to executed commands. Only the synchronous version is affected; the asynchronous shell.exec() and other shelljs functions are not impacted. The vulnerability was patched in version 0.8.5.
Affected products
- ShellJS ShellJS < 0.8.5
Timeline
- 2022-01-14: disclosed
- 2022-01-14: patched: Fixed in version 0.8.5