CVE-2020-7627

Vulnerability

Description node-key-sender is a Node.js module that sends keyboard events to the operating system. Versions up to and including 1.0.11 are vulnerable to command injection due to insufficient sanitization of user-controlled input passed to the arrParams argument in the execute() function. The issue exists in the key-sender.js file at line 117, where unsanitized parameters are directly passed to a system command [1][2][3].

Attack

Vector The vulnerability is triggered when an attacker supplies a malicious value to the arrParams parameter. For example, providing an array like ["&touch", "Song"] results in the injected &touch command being executed along with the intended keyboard event function. No authentication is required to exploit this; any application using the vulnerable version of the library and allowing user-controlled input to reach this function is at risk [1].

Impact

Successful exploitation allows an attacker to execute arbitrary operating system commands with the same privileges as the Node.js process. This can lead to complete compromise of the application and potentially the underlying system, depending on the runtime environment [1][2].

Mitigation

As of the publication date, no patched version of node-key-sender has been released. The only recommended mitigation is to avoid using this package in production or to replace it with an alternative that does not expose command injection vulnerabilities [1]. The vulnerability is publicly documented and a proof-of-concept has been provided, increasing the risk of active exploitation.