Executive brief
wizard-syncronizer is a Node.js package used to synchronize widgets with remote repositories. The package fails to validate user input when cloning repositories, allowing attackers to inject arbitrary shell commands. This could enable an attacker to execute malicious code with the privileges of the process running the application, potentially leading to complete system compromise.
Technical details
The vulnerability is a command injection flaw in the cloneAndSync function that fails to sanitize the gitURL parameter before passing it to an exec() system call. An attacker can embed shell metacharacters in a malicious widget's gitURL value or exploit a man-in-the-middle attack (due to lack of HTTPS enforcement) to inject arbitrary commands. This allows remote code execution on the affected system. No patch has been released; users are advised to migrate to an alternative package.
Affected products
- npm wizard-syncronizer all versions
Timeline
- 2020-09-11: disclosed