GHSA-mxjr-xmcg-fg7w Arbitrary Code Injection in mobile-icon-resizer

Not scored Published 27 Jun 2019

Attackers can execute arbitrary JavaScript code by providing malicious configuration files to the mobile-icon-resizer library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Not stated
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-mxjr-xmcg-fg7w?

GHSA-mxjr-xmcg-fg7w is a code injection vulnerability in mobile-icon-resizer, published on 27 Jun 2019.

Official description

mobile-icon-resizer resizes large images for use as icons for iOS and Android.

mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3.

mobile-icon-resizer takes an options object as an argument to define the resulting icons as such:

var options = {
  config: &#39;./config.js&#39;
}
resize(options, function(err){});

config.js would need to be a file on the filesystem and look something like:

var config = {
  iOS: {
    &#34;images&#34;: [
     /* iOS image definitions are not vulnerable */
    ]
  },
  android: {
    &#34;images&#34; : [
      {
        &#34;baseRatio&#34; : &#34;console.log(&#39;Executing script as baseRatio property&#39;)&#34;,
        &#34;folder&#34; : &#34;drawable-ldpi&#34;
      },
      {
        &#34;ratio&#34; : &#34;console.log(&#39;Executing script as ratio property&#39;)&#34;,
        &#34;folder&#34; : &#34;drawable-mdpi&#34;
      },
    /* other android image defintiions ... */
    ]
  }
};

exports = module.exports = config;

The parameters ratio and baseRatio are passed directly to eval(), thus allowing dynamic javascript payloads to be executed.

Recommendation

Update to version 0.4.3 or later.

Which versions are affected by GHSA-mxjr-xmcg-fg7w?

2 open source packages ship an affected version, including mobile-icon-resizer.

Package	Affected	Fixed in
`mobile-icon-resizer` npm	From `0.2.0`	`0.4.3`
`mobile-icon-resizer` npm	From `0.2.0`	`0.4.3`

How do I fix GHSA-mxjr-xmcg-fg7w?

Upgrade mobile-icon-resizer to 0.4.3 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is GHSA-mxjr-xmcg-fg7w being exploited?

There is no known exploitation of GHSA-mxjr-xmcg-fg7w in the wild and no public exploit code.