CVE-2021-42740

What it actually does

The vulnerability in the shell-quote Node.js package is a command injection flaw caused by an improper regular expression used for sanitization. The regex `{A-z]` was intended to match Windows drive letters but incorrectly allows shell metacharacters (such as the backtick `) that fall between 'Z' and 'a' in the ASCII table to pass through without being escaped. If an application uses this library to quote user-provided input and then passes the result to a shell execution function like `exec()`, an attacker can inject and execute arbitrary commands with the permissions of the Node.js application process.

Why it matters to the business

An attacker can gain full control over the server running the vulnerable application, leading to remote code execution. This can result in the theft of sensitive data, such as customer information or intellectual property, service disruption, or using the compromised server to launch further attacks against the internal network. Given the critical CVSS score of 9.8, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected system.

How an attack unfolds

An unauthenticated, remote attacker identifies an application that uses a vulnerable version of the `shell-quote` library to process user input before passing it to a system shell. The attacker crafts a malicious string containing shell metacharacters, such as backticks enclosing a command (e.g., `` `whoami` ``). This string is submitted to the application. The vulnerable library fails to properly escape the backticks. When the application concatenates this improperly sanitized string into a command and executes it via a function like `child_process.exec()`, the operating system's shell interprets the backticks, executes the attacker's embedded command, and substitutes its output, leading to a full command injection.

How to fix it

The vulnerability is patched in version 1.7.3 of the `shell-quote` package. Update the dependency to version 1.7.3 or later. Use your package manager to perform the upgrade, for example, by running `npm install shell-quote@latest` or `yarn upgrade shell-quote`. Ensure that your `package-lock.json` or `yarn.lock` file is updated and committed to reflect the fixed version.

How to confirm the fix worked

To confirm remediation, verify that the version of `shell-quote` in your project's dependency tree is 1.7.3 or higher. You can check the installed version by running `npm ls shell-quote` or `yarn list --pattern shell-quote` in your project's root directory. Additionally, use a Software Composition Analysis (SCA) tool to scan your application's dependencies for this and other known vulnerabilities to ensure all direct and transitive dependencies are secure.

Typical attack path

1. An attacker identifies a target application using a vulnerable version of the Node.js `shell-quote` library.
2. The attacker crafts a malicious input string containing unescaped shell metacharacters, such as `` `id` ``, designed to exploit the flawed regex.
3. The attacker sends this malicious string to an application endpoint that processes it with the vulnerable library.
4. The `shell-quote` library fails to properly sanitize the input, leaving the metacharacters intact.
5. The application passes the malformed string to a shell execution function.
6. The underlying system shell executes the injected command, giving the attacker code execution on the server.

How to detect it

Monitor process execution logs on servers running Node.js applications for anomalous activity. Look for the `node` process spawning unexpected child processes, particularly common shell utilities like `sh`, `bash`, `whoami`, `id`, `uname`, `wget`, `curl`, or `nc`. Examine application and web server logs for inbound requests containing unusual characters like backticks (`) within parameters that are likely passed to shell commands.

• Process execution event where parent process is `node` and child process is `sh` or `bash` with suspicious arguments.
• Process execution event where parent process is `node` and child process is `whoami`, `id`, `uname`, `wget`, `curl`, or `nc`.
• Application log entries containing input strings with backticks, such as `` `...` ``.

What your security team should do

• Immediately identify all Node.js applications using `shell-quote` and prioritize patching for internet-facing systems.
• Update the `shell-quote` package to version 1.7.3 or newer across all affected codebases.
• Run Software Composition Analysis (SCA) scans to discover all instances of the vulnerable package, including as a transitive dependency.
• As a defense-in-depth measure, review code for any use of shell execution functions (`exec`, `spawn`) and avoid passing user-controllable data to them whenever possible.