Executive brief
tomato is a Node.js module used for executing commands. A command injection vulnerability in the /api/exec endpoint allows attackers to execute arbitrary system commands without validation. This could lead to complete system compromise, data theft, or unauthorized service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the /api/exec endpoint of tomato. The endpoint fails to validate or sanitize user input before passing it to system command execution functions. An attacker can send crafted input containing shell metacharacters or command separators to execute arbitrary commands with the privileges of the process running tomato. No authentication or special preconditions are mentioned, suggesting the endpoint is likely network-accessible. No fix is currently available as of the advisory publication date.
Affected products
- npm tomato all versions
Timeline
- 2020-09-02: disclosed