CVE-2020-15477
Description
The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- RaspberryTortoise/RaspberryTortoisedescription
- Range: <= 2012-10-28
Patches
Vulnerability mechanics
Root cause
"Missing input validation on the `incomingString` parameter before passing it to `child_process.exec` allows shell metacharacter injection."
Attack vector
An attacker sends an HTTP request to one of the WebControl endpoints (e.g., `/backward?0.05;wget${IFS}127.0.0.1/abcd`) [ref_id=1]. The `incomingString` parameter is concatenated into a shell command via `child_process.exec` without sanitization, allowing shell metacharacters such as `;` to inject arbitrary commands [ref_id=1]. The attack is remote and requires only network access to the RaspberryTortoise WebControl server [ref_id=1].
Affected code
The vulnerable file is `nodejs/raspberryTortoise.js`. The parameter `incomingString` is passed directly to `child_process.exec` without any validation or sanitization [ref_id=1]. The affected components are the HTTP endpoints `backward`, `forward`, `left`, and `right` [ref_id=1].
What the fix does
No patch is provided in the bundle. The advisory recommends that input validation be added to `nodejs/raspberryTortoise.js` so that the `incomingString` parameter is sanitized before being passed to `child_process.exec` [ref_id=1]. Using `child_process.execFile` or `child_process.spawn` with an argument array instead of a shell string would also prevent shell metacharacter injection [ref_id=1].
Preconditions
- networkThe RaspberryTortoise WebControl server must be running and reachable over the network.
- authNo authentication is required to access the vulnerable endpoints.
Reproduction
1. Start the RaspberryTortoise WebControl as described at https://github.com/raspberrytorte/tortoise/tree/master/nodejs [ref_id=1]. 2. Start a local HTTP server (e.g., `python3 -m http.server 80`) to observe the callback [ref_id=1]. 3. Visit `http://127.0.0.1:8080/backward?0.05;wget${IFS}127.0.0.1/abcd` [ref_id=1]. 4. A request will be received on the local HTTP server, confirming code execution [ref_id=1]. The same technique works on `/forward`, `/left`, and `/right` endpoints [ref_id=1].
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85mitrex_refsource_MISC
- github.com/raspberrytorte/tortoise/tree/master/nodejsmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.