Summary
A Command Injection vulnerability was discovered in gnuplot-heatmap through the
outFile option.
Product
All versions of gnuplot-heatmap.
Impact
It’s possible to inject malicious shell code. While the gnuplot-heatmap library
itself doesn’t run the Gnuplot program, it generates code with the purpose of
being piped to it.
Steps to reproduce
In order to exploit this vulnerability execute a file such as the following:
console.log(require("gnuplot-heatmap").default({
title: "Contributions",
data: [0, 1, 2, 3, 4, 5],
year: 2019,
outFile: 'heatmap.png"nsystem("echo PWND > PWND")nset title "',
}));Tested on 1.0.2.
Remediation
The library hasn’t been updated to fix the vulnerability. Instead, it was
deprecated in favor of another library — learn more about it on the NPM
page.
Credit
This issue was discovered and reported by Checkmarx SCA Security Researcher
André Sá.
