CVE-2023-26129

Vulnerability

Overview

The bwm-ng package for Node.js is vulnerable to command injection in all versions. The flaw resides in the check function within bwm-ng.js, which fails to properly sanitize user-supplied input. This allows an attacker to inject arbitrary OS commands that are subsequently executed by the application [1][2].

Exploitation

Requirements

To exploit this vulnerability, an attacker must have the ability to execute Node.js code in the target environment. This typically means they already have some level of access to the system or application hosting the Node.js runtime. A proof-of-concept (PoC) demonstrates injecting a command like ;touch EXPLOITED; into the interface array argument of the check function [2].

Impact and

Mitigation

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the Node.js process. This can lead to full system compromise, data exfiltration, or further lateral movement. As of the publication date, there is no fixed version available for bwm-ng. Until a patch is released, users should avoid passing unsanitized input to the check function or consider using alternative packages [1][2].