CVE-2019-10788

Vulnerability

Overview

CVE-2019-10788 is a command injection vulnerability in the npm package im-metadata, affecting all versions up to 3.0.1. The package is used to retrieve image metadata as a JSON object using ImageMagick's identify command. The vulnerability stems from insufficient input sanitization: the package passes user-supplied metadata options directly to the exec function without proper validation, allowing an attacker to inject arbitrary shell commands [1][2].

Attack

Vector

The vulnerability is triggered by passing malicious input through the exec argument when calling the package's function. For example, an attacker could supply a file path containing shell metacharacters such as ;, |, or backticks. A proof-of-concept (PoC) provided by the Snyk Security Team demonstrates exploitation by appending a command after the file path, like foo.jpg;ls, which executes the ls command [2]. No authentication is required, and the attack can be carried out remotely if the application accepts user-controlled filenames or options.

Impact

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the application process. This could lead to full compromise of the affected system, including data exfiltration, installation of malware, or further lateral movement within the network. The impact is rated as critical due to the ease of exploitation and the potential for complete system takeover [1].

Mitigation

The issue was addressed in a commit to the package's master branch on GitHub, which added input validation by checking the path argument for suspicious characters before processing [3]. However, as of the publication date, a patched version had not been published to the npm registry. Users of im-metadata should upgrade to a patched version as soon as it becomes available or implement input sanitization and avoid passing untrusted data to the exec argument. The repository has since been archived [3].