CVE-2013-7378

Vulnerability

Overview

The vulnerability resides in scripts/email.coffee of the Hubot Scripts module for Node.js, prior to version 2.4.4. The sendEmail function constructs a shell command by interpolating user-supplied input directly into a string passed to child_process.exec(). Specifically, the email subject and message fields are concatenated into a command string without any sanitization or escaping [1][4]. This allows an attacker to inject arbitrary shell commands through the email subject or message parameters.

Exploitation

An attacker can exploit this by sending a crafted request to the Hubot instance that triggers the email command. The vulnerable command is activated via a chat message matching the pattern /email (.*) -s (.*) -m (.*)/i, where the first group provides recipients, the second is the subject, and the third is the message body. The subject and message are inserted directly into a shell command, so an attacker can include shell metacharacters (e.g., backticks, $(), semicolons) to execute arbitrary commands on the server running Hubot [3]. The fix, introduced in commit feee5ab, replaces exec() with execFile() and passes arguments as an array, preventing shell injection [4].

Impact

Successful exploitation allows a remote attacker to execute arbitrary operating system commands with the privileges of the Hubot process. This can lead to full compromise of the server, including data exfiltration, installation of malware, or pivot attacks within the network. The Node Security Project advisory for this issue noted it as a potential command injection vulnerability [2].

Mitigation

The vulnerability is fixed in Hubot Scripts version 2.4.4 and later. Users should upgrade to at least that version. No workaround is provided; the only remediation is to apply the patch. The CVE was published on 2020-02-12, but the vulnerability was originally reported in 2014 [1].