CVE-2022-25923

Vulnerability

Overview

The exec-local-bin package before version 1.2.0 is vulnerable to Command Injection via the theProcess() functionality. The root cause is improper user-input sanitization, allowing an attacker to inject arbitrary shell commands. The vulnerability exists because the package constructs a command string by directly concatenating user-supplied input (the bin parameter) with a hardcoded path, then executes it using child_process.exec without validation [1][3].

Exploitation

Details

An attacker can exploit this vulnerability by passing a malicious bin argument containing shell metacharacters. For example, passing a string like "& touch JHU" causes the exec function to interpret the ampersand as a command separator, executing the injected command (touch JHU) on the system [4]. No authentication is required; the attack vector is via any function call that supplies the bin parameter to theProcess(). Successful exploitation depends on the application using the package with attacker-controllable input.

Impact

Successful command injection allows an attacker to execute arbitrary operating system commands with the privileges of the application or user running the Node.js process. This can lead to full system compromise, data exfiltration, or further lateral movement within the environment [1].

Mitigation

The vulnerability has been patched in version 1.2.0. The fix replaces direct string concatenation with path.join, validates that the resolved binary path stays within the expected node_modules/.bin directory, and checks file accessibility before execution [3]. Users should upgrade to version 1.2.0 or later. As of publication, no active exploitation in the wild has been reported, but given the ease of exploitation, immediate patching is recommended [4].