Summary
Affected versions of the NPM package ssh2 allow command injection through the unsafe execution of user-controlled parameters.
Product
This vulnerability affects versions of ssh2 prior to 1.0.0.
Impact
This issue may lead to remote code execution if malicious input is passed to the agent parameter.
Steps to reproduce
- An SSH server must be running.
- Create the file
poc.js:require('ssh2')().connect({ 'agent': "/"& echo vulnerable > result"", 'username': "checkmarx", 'tryKeyboard': true }) - Run
node poc.js
Expected result:
A file named result will be created with “vulnerable” written inside.
Remediation
- Update to version 1.0.0 or above.
- As a workaround, make sure untrusted input can’t be passed to the vulnerable parameters when using the library.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analysts André Sá and Mário Teixeira.
