CVE-2025-57285
BaseFortify
Publication date: 2025-09-08
Last updated on: 2025-09-12
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codecept | codeceptjs | 3.7.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-57285 is a command injection vulnerability in codeceptjs version 3.7.3, specifically in the emptyFolder function in lib/utils.js. The vulnerability occurs because the execSync command concatenates a user-controlled directoryPath parameter directly into a shell command without sanitization or escaping. This allows an attacker to inject and execute arbitrary shell commands on the system. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary shell commands on the system running codeceptjs 3.7.3. This could lead to unauthorized file creation, modification, deletion, or other malicious actions depending on the commands executed, potentially compromising the system's integrity and security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the codeceptjs version 3.7.3 is in use and if the emptyFolder function in lib/utils.js is called with user-controlled input that is not sanitized. One practical detection method is to look for unexpected files created by command injection, such as files named 'Dremig486' as demonstrated in the PoC. You can run commands like `ls -l` in directories where codeceptjs runs to check for suspicious files. Additionally, searching the codebase for usage of execSync with unsanitized inputs can help identify vulnerable code. For example, you can use: `grep -r "execSync" ./lib/utils.js` to find the vulnerable function. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading codeceptjs to a version where this vulnerability is fixed (if available). If an upgrade is not possible, avoid using or calling the emptyFolder function with user-controlled input. Additionally, sanitize or escape any input passed to execSync commands to prevent command injection. Restrict permissions and isolate environments where codeceptjs runs to limit potential damage from exploitation. [1]