CVE-2020-7621

Vulnerability

Overview

The strong-nginx-controller npm package through version 1.0.2 contains a command injection vulnerability in the _nginxCmd() function. The first argument passed to this function can be attacker-controlled and is executed without any sanitization, allowing an arbitrary OS command to be injected [1][2]. The vulnerable code resides in lib/server.js at line 65 [3].

Exploitation

Method

An attacker can exploit this by providing a crafted action parameter to the _nginxCmd() function. The public PoC demonstrates that by passing a value such as "& touch Song" as the action argument, the injected command will be executed on the system where the controller is running [1]. No prior authentication is required to reach the vulnerable function if the attacker can influence the parameters that flow into the call.

Impact

Successful exploitation allows an attacker to execute arbitrary operating system commands in the context of the Node.js process running the strong-nginx-controller package. This can lead to full compromise of the host system, including data exfiltration, further lateral movement, or denial of service [1][2].

Mitigation

Status

As of the advisory publication date (April 2, 2020), no fixed version of strong-nginx-controller was available [1]. Users are advised to evaluate their dependency on this package and consider replacing it with an alternative that does not contain this vulnerability, or to implement strict input validation and sanitization for any user-controlled data passed to the controller.