Summary
Affected versions of the coveralls npm package are vulnerable to command injection attack via unsafe exec usage in fetchGitData.js.
Product
Coveralls before 3.1.1.
Impact
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
Steps to reproduce
poc.js:
process.env.COVERALLS_GIT_COMMIT = "; touch HACKED;"
var coveralls = require("coveralls")
coveralls.getBaseOptions((a, b) => {});Expected result:
A file named HACKED will be created.
Remediation
- Avoid passing untrusted input into the vulnerable parameters when using the library.
- Update
coverallsto version 3.1.1.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Adar Zandberg.
