Executive brief
wxchangba is an npm package used for handling material file uploads and processing. The package fails to validate user input in its file parameter, allowing attackers to inject arbitrary shell commands that execute on the server with the same privileges as the application.
Technical details
wxchangba contains a command injection vulnerability in the reqPostMaterial function due to insufficient input validation on the file parameter. User-supplied input is passed directly to an exec call without sanitization, enabling arbitrary command execution. The vulnerability affects all published versions of the package. No patch is currently available; the maintainers recommend users switch to an alternative module until a fix is released.
Affected products
- wxchangba wxchangba all versions
Timeline
- 2020-09-11: disclosed