Command Injection Vulnerability in BrowserStack Local Package
Summary
GHSA-g4w6-c99w-4wh7: BrowserStack Local vulnerable to Command Injection through logfile variable. Affects browserstack-local versions < 1.5.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BrowserStack Local is a Node.js package that allows developers to test their web applications on various browsers and devices. It provides a secure tunnel to access local servers and enables seamless testing of web applications in real-time. The package is widely used for its ability to facilitate cross-browser testing without the need for complex configurations. However, a vulnerability has been identified in version 1.5.8 that could potentially compromise the security of applications using this package.
Vulnerability Detail
The vulnerability in BrowserStack Local arises from improper sanitization of the 'logfile' variable in the lib/Local.js file. This oversight allows attackers to inject arbitrary commands into the system, leading to command injection attacks. If exploited, this vulnerability could allow an attacker to execute malicious commands on the server where the application is running, potentially leading to data breaches, unauthorized access, or complete system compromise. The severity of this vulnerability is classified as moderate, with a CVSS score of 6.6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to avoid using the 'logfile' variable in your configuration until the package can be updated. This can help mitigate the risk of command injection while you plan for a proper fix.
Conclusion
The command injection vulnerability in BrowserStack Local version 1.5.8 poses a moderate risk to applications using this package. It is crucial to update to the latest version to safeguard against potential exploitation. Additionally, utilizing tools like Vulert can help monitor your application for vulnerabilities in real-time.
See every vulnerability recorded for browserstack-local →
FAQ
The command injection vulnerability allows attackers to execute arbitrary commands on the server due to improper sanitization of the 'logfile' variable.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, or complete system compromise, posing significant risks to your application and its users.
Yes, updating to the latest version of the BrowserStack Local package will address the command injection vulnerability.
As a temporary measure, avoid using the 'logfile' variable in your configuration to mitigate the risk of command injection until you can update the package.
