Summary
When using config-shield in CLI mode, malicious code could be executed when passed through the ‘set’ command.
Product
config-shield before 0.2.3
Impact
This issue may lead to remote code execution if a server running the library uses the vulnerable command with untrusted input.
Steps to reproduce
> npm run start
- enter path of config (enter to use existing path)>
- enter path of private key (press enter to use private key path in config)>
: loading...done
> set require("child_process").exec("touch HACKED")
> exitExpected result:
A file named HACKED has been created.
Remediation
Always sanitize untrusted input. Update to the nonvulnerable [email protected].
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Adar Zandberg.
