CVE-2020-7606: OS Command Injection in docker-compose-remote-api
Summary
CVE-2020-7606: OS Command Injection in docker-compose-remote-api. Affects docker-compose-remote-api versions < 0.1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
docker-compose-remote-api is an npm package that provides remote API functionality for Docker Compose. It allows users to interact with Docker Compose through a remote API. The package is vulnerable to OS command injection, which can lead to the execution of arbitrary commands. This vulnerability exists within the 'index.js' file of the package, specifically in the 'exec(serviceName, cmd, fnStdout, fnStderr, fnExit)' function. The 'serviceName' variable used in this function is not properly sanitized, allowing users to control it and inject malicious commands.
Vulnerability Detail
The OS command injection vulnerability in docker-compose-remote-api enables attackers to execute arbitrary commands on the host system. By manipulating the 'serviceName' variable without proper sanitization, an attacker can inject malicious commands that will be executed by the application. This can lead to various security risks, including unauthorized access, data breaches, and remote code execution. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to manually sanitize the 'serviceName' variable before passing it to the 'exec' function. This can be done by validating and sanitizing user input to remove any potentially malicious characters or commands. Here's an example of how to sanitize the 'serviceName' variable in JavaScript:
const sanitizedServiceName = serviceName.replace(/[;&|`$()\]/g, '');
exec(sanitizedServiceName, cmd, fnStdout, fnStderr, fnExit);
Conclusion
The OS command injection vulnerability in docker-compose-remote-api poses a significant security risk, allowing attackers to execute arbitrary commands on the host system. It is crucial to update the package to version 0.1.5 or later to mitigate this vulnerability. Alternatively, you can apply the provided workaround to sanitize user input. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for docker-compose-remote-api →
FAQ
docker-compose-remote-api is an npm package that provides remote API functionality for Docker Compose. It allows users to interact with Docker Compose through a remote API, enabling the management of Docker containers and services programmatically.
OS command injection is a security vulnerability that allows an attacker to execute arbitrary commands on the host operating system. It occurs when user-supplied input is not properly validated or sanitized before being passed to a system command.
The OS command injection vulnerability in docker-compose-remote-api can lead to unauthorized access, data breaches, and remote code execution. Attackers can exploit this vulnerability to execute arbitrary commands with the privileges of the application, potentially compromising the entire host system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file. It provides a comprehensive analysis of vulnerabilities and their impact.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability in docker-compose-remote-api. However, it is crucial to address this vulnerability promptly by updating the package to the latest version or applying the recommended workaround.
