Summary
A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value __proto__ to the “parse()” method, an attacker can bypass checks against values set in _execs[] to execute an external file which was not intended.
Product
Commander.js before version 2.20.1 and 3.x before 3.0.2.
Impact
With the right conditions an attacker could run ability commands on the server.
Steps to reproduce
- Create a file named
poc-__proto__with the shell command in it with a given execution permissions (+x) - Create
poc.jswith the code:var program = require('commander'); console.log(program.parse(process.argv)); - Run
Node poc.js __proto__
Expected result:
The shell command in the file poc-__proto__ will run.
Remediation
Update Commander.js plugin to 2.20.1 or 3.0.2 or above.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Dor Tumarkin.
