High, CVSS 7.3npmAmendedPublished
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
GHSA-fm76-w8jw-xf8m
- Affected
- npm @saltcorn/plugins-loader <= 1.0.0-beta.13
- Fixed in
- 1.0.0-beta.14· Vendor fix available
- Issue
- When creating a new plugin using the git source, the user-controlled value req.body.name is used to build the plugin directory where the location will be cloned. The API used to execute the git clone command with the user-controlled data is childprocess.execSync. Since the user-controlled data is not validated, a user with admin permission can add escaping characters and execute arbitrary commands, leading to a command injection vulnerability. Details Relevant code from source (req.body) to sink (childprocess.execSync). - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/plugins.js#L1400 - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/saltcorn-data/models/plugin.ts#L44 - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/loadplugins.js#L64-L65 - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugininstaller.js#L41-L61 - file:…
Recommended action: Upgrade to 1.0.0-beta.14 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.