CVE-2013-7377: Command Injection in codem-transcode
Summary
CVE-2013-7377: Potential Command Injection in codem-transcode. Affects codem-transcode versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
codem-transcode is an npm package that provides functionality for transcoding media files. It includes an optional feature to enable ffprobe, a tool for analyzing media files. By default, ffprobe functionality is disabled, and the server binds to the local interface. However, when ffprobe is enabled, HTTP POST requests can be made to the /probe endpoint, which passes the requests to the ffprobe binary on the server. This vulnerability allows an attacker to execute arbitrary commands by sending a malformed source file name to ffprobe.
Vulnerability Detail
The vulnerability arises from the lack of input validation in the handling of source file names by ffprobe. An attacker can exploit this by crafting a malicious source file name that includes arbitrary commands. When this file name is passed to ffprobe through the /probe endpoint, the commands will be executed with the privileges of the server. This can lead to various consequences, such as unauthorized access, data leakage, or even complete compromise of the server.
How To Fix
Minimum fixed version
0.5.0
This is the first release that contains the fix.
npm install codem-transcode@0.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround is to disable the ffprobe functionality by modifying the server configuration. By disabling ffprobe, the vulnerable endpoint (/probe) will no longer be accessible, mitigating the risk of command injection. The specific steps to disable ffprobe may vary depending on the server configuration and deployment environment.
Conclusion
The command injection vulnerability in codem-transcode can be mitigated by upgrading to version 0.5.0 or by disabling the ffprobe functionality. It is important to take prompt action to protect your system from potential exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codem-transcode →
FAQ
codem-transcode is an npm package that provides functionality for transcoding media files. It includes features for analyzing media files using ffprobe.
The vulnerability occurs due to the lack of input validation in the handling of source file names by ffprobe. An attacker can exploit this by sending a specially crafted source file name that includes arbitrary commands.
The consequences of this vulnerability can vary depending on the privileges of the server. However, it can lead to unauthorized access, data leakage, or complete compromise of the server.
No, the ffprobe functionality is not enabled by default. It needs to be explicitly enabled in the server configuration.
To fix this vulnerability, it is recommended to upgrade to version 0.5.0 of the codem-transcode module. Alternatively, you can disable the ffprobe functionality in the server configuration.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
