Command Injection

Affecting shell-quote package, versions <1.6.1

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

shell-quote is a package used to quote and parse shell commands.

Affected versions of this package are vulnerable to Command Injection. The quote function does not properly escape the following special characters <, >, ;, {, } , and as a result can be used by an attacker to inject malicious shell commands or leak sensitive information.

Proof of Concept

Consider the following poc.js application

var quote = require('shell-quote').quote;
var exec = require('child_process').exec;

var userInput = process.argv[2];

var safeCommand = quote(['echo', userInput]);

exec(safeCommand, function (err, stdout, stderr) {
  console.log(stdout);
});

Running the following command will not only print the character a as expected, but will also run the another command, i.e touch malicious.sh

$ node poc.js 'a;{touch,malicious.sh}'

Remediation

Upgrade shell-quote to version 1.6.1 or higher.

References

Snyk patch available for versions:

CVSS Score

8.4
high severity
  • Attack Vector
    Local
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credit
Koki Takahashi, Node Security Team
CVE
CVE-2016-10541
CWE
CWE-78
Snyk ID
npm:shell-quote:20160621
Disclosed
21 Jun, 2016
Published
21 Jun, 2016