Executive brief
The traceroute npm package is a Node.js wrapper around the native traceroute command used for network diagnostics. The package fails to sanitize user-supplied input and passes it directly to a shell execution call, allowing attackers to inject arbitrary shell commands. An attacker who controls the host parameter can achieve remote code execution on systems running this package.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the trace() function of the traceroute npm package. The vulnerable component accepts a host parameter and passes it unsanitized to an exec() call without proper input validation or escaping. An attacker can inject shell metacharacters (such as newlines) followed by arbitrary commands to break out of the intended command context. No authentication or special privileges are required—any caller of the trace() function with attacker-controlled input can exploit this. The attack achieves arbitrary code execution with the privileges of the Node.js process. A fix exists on the repository's master branch but has not been published to npm as of the advisory date.
Affected products
- npm traceroute <=1.0.0
Timeline
- 2017-11-09: disclosed
- 2020-09-04: advisory: GHSA-rjvj-673q-4hfw published