Executive brief
soletta-dev-app is a Node.js package for developing Soletta applications. A command injection vulnerability in the /api/service/status endpoint allows unauthenticated attackers to execute arbitrary system commands by injecting malicious input into the service query parameter. This could lead to complete system compromise, data theft, or denial of service.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the /api/service/status API endpoint. The package fails to sanitize or validate the service query parameter before passing it to an exec system call, allowing an attacker to inject arbitrary shell commands. An unauthenticated attacker on the network can exploit this via a crafted HTTP request to execute code with the privileges of the application process. No fix is currently available; the advisory recommends using an alternative module.
Affected products
- Intel soletta-dev-app all versions
Timeline
- 2020-09-11: disclosed
- 2020-08-31: advisory: GitHub reviewed