This repository has been archived by the owner on Dec 19, 2023. It is now read-only.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
📊 Metadata *
Please enter the direct URL for this bounty on huntr.dev. This is compulsory and will help us process your bounty submission quicker.
Bounty URL: https://www.huntr.dev/app/bounties/open/1-npm-curlrequest
⚙️ Description *
curlrequest
module suffers from a Command Injection vulnerability caused by the lack of sanitizing the input arguments before executing it.💻 Technical Description *
curlrequest
is acurl
utility library/module for Node projects. It covers a variety of features but it works with thecommand utility
after processing the input where every input is turned into acurl
command and blindly executed by thespawn()
function.The
spawn()
function is required here but the cause of this issue is actually because of the lack of sanitization of user input.To fix the issue, I used a module
shell-escape
which converts arguments into shell-friendly and safe escaped strings. As thecurl
command can contain a lot of special characters from URLs, it's not a problem faced with the usage of this module as the suggested example from the documentation showcases the use of thecurl
command as arguments.🐛 Proof of Concept (PoC) *
Place this file under the root directory of the project (
poc.js
)🔥 Proof of Fix (PoF) *
As you can see from the above screenshot, the payload didn't get executed.
👍 User Acceptance Testing (UAT)
The
POC
demonstrates an all-around test of the code. The test also showed that this project usesBuffer()
which is deprecated due tosecurity
andusability
issues. As it poses a security risk, I fixed the issue by moving toBuffer.alloc()
which is a safe method to use.The node console warning:
DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
So the only change pushed to the code is:
Buffer()
toBuffer.alloc()
which also fixes another security issue.shell-escape
module to sanitize the command arguments to mitigate theCommand Injection
.