GHSA-4qqc-mp5f-ccv4 Command Injection in bestzip
Attackers can execute arbitrary system commands via unsanitized input in the bestzip library if the destination path is user-controlled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4qqc-mp5f-ccv4?
GHSA-4qqc-mp5f-ccv4 is a command injection vulnerability in bestzip, published on 2 Sep 2020.
Official description
Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled. This only affects users with a native zip command available. The following examples demonstrate the issue from the CLI and also programatically:
bestzip test.zip 'sourcefile; mkdir folder'zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })
Which versions are affected by GHSA-4qqc-mp5f-ccv4?
2 open source packages ship an affected version, including bestzip.
| Package | Affected | Fixed in |
|---|---|---|
bestzip npm | All versions | 2.1.7 |
bestzip npm | All versions | 2.1.7 |
How do I fix GHSA-4qqc-mp5f-ccv4?
Upgrade bestzip to 2.1.7 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-4qqc-mp5f-ccv4 being exploited?
There is no known exploitation of GHSA-4qqc-mp5f-ccv4 in the wild and no public exploit code.