Security Fix for Remote Code Execution - huntr.dev

huntr-helper commented 4 years ago

https://huntr.dev/users/Asjidkalam has fixed the Remote Code Execution vulnerability 🔨. Asjidkalam has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

User Comments:

📊 Metadata *

Command injection vulnerability

Bounty URL: https://www.huntr.dev/bounties/1-npm-git-revision-webpack-plugin/

⚙️ Description *

The git-revision-webpack-plugin module is vulnerable against RCE since a command is crafted using user inputs not validated and then executed, leading to arbitrary command injection. The argument options can be controlled by users without any sanitization. It was using exec() function which is vulnerable to Command Injection if it accepts user input and it goes through any sanitization or escaping.

💻 Technical Description *

The use of the child_process function exec() is highly discouraged if you accept user input and don't sanitize/escape them. I replaced it with execFile() which mitigates any possible Command Injections as it accepts input as arrays.

🐛 Proof of Concept (PoC) *

Install the package and run the below code, you'll need to have a PDF to test:

var GitRevisionPlugin = require('git-revision-webpack-plugin');
var test = new GitRevisionPlugin({'gitWorkTree':'s', 'commithashCommand':'test; touch HACKED; #', 'branchCommand':'s'});
test.commithash();

A file named HACKED will be created in the current working directory.

🔥 Proof of Fix (PoF) *

After applying the fix, run the PoC again and no files will be created. Hence command injection is mitigated.

👍 User Acceptance Testing (UAT)

Only execFile is used, no breaking changes introduced.

JamieSlome commented 4 years ago

@pirelenito - let me know if you have any questions or thoughts.

Cheers! 🍰

pirelenito commented 4 years ago

Thanks for reaching out @JamieSlome, but as stated in the documentation:

This configuration is not not meant to accept arbitrary user input and it is executed by the plugin without any sanitization.

This was previously reported and closed. See: https://github.com/pirelenito/git-revision-webpack-plugin/issues/49#issuecomment-613617147

I'll close this PR for now, but ping me if you feel that the existing documentation solution is not sufficient.

Thanks.

JamieSlome commented 4 years ago

@pirelenito Thanks for the swift response and pointing this out.

Cheers 👍

pirelenito / git-revision-webpack-plugin