CVE-2020-7735: OS Command Injection in ng-packagr

Background

ng-packagr is an npm package used for compiling and packaging Angular libraries. It provides a command-line interface (CLI) for building and publishing Angular packages. The package is widely used in Angular projects to create reusable components and libraries. However, versions before 10.1.1 are vulnerable to OS Command Injection through the styleIncludePaths option.

Vulnerability Detail

The vulnerability in ng-packagr allows an attacker to execute arbitrary commands on the host system by injecting malicious commands through the styleIncludePaths option. This can lead to unauthorized access, data leakage, or even complete compromise of the host system. The vulnerability is rated as MODERATE severity with a CVSS score of 6.6. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-78.

npm install ng-packagr@10.1.1

Workaround

If upgrading to the latest version is not immediately possible, a temporary workaround is to avoid using the styleIncludePaths option or ensure that user input is properly validated and sanitized before passing it to this option. Here is an example of how to sanitize user input in a Node.js application:

const { exec } = require('child_process');

function sanitizeInput(input) {
  // Implement input sanitization logic here
  return input.replace(/[;|&$<>]/g, '');
}

const styleIncludePaths = sanitizeInput(userInput);

exec(`ng-packagr --styleIncludePaths=${styleIncludePaths}`, (error, stdout, stderr) => {
  // Handle the command execution and output
});

Conclusion

In conclusion, the ng-packagr package before version 10.1.1 is vulnerable to OS Command Injection. It is crucial to upgrade to the latest version or apply the recommended workarounds to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for ng-packagr →

FAQ