Executive Summary

CVE-2025-57285 is a command injection vulnerability in codeceptjs version 3.7.3, specifically in the emptyFolder function in lib/utils.js. The vulnerability occurs because the execSync command concatenates a user-controlled directoryPath parameter directly into a shell command without sanitization or escaping. This allows an attacker to inject and execute arbitrary shell commands on the system. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary shell commands on the system running codeceptjs 3.7.3. This could lead to unauthorized file creation, modification, deletion, or other malicious actions depending on the commands executed, potentially compromising the system's integrity and security. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the codeceptjs version 3.7.3 is in use and if the emptyFolder function in lib/utils.js is called with user-controlled input that is not sanitized. One practical detection method is to look for unexpected files created by command injection, such as files named 'Dremig486' as demonstrated in the PoC. You can run commands like `ls -l` in directories where codeceptjs runs to check for suspicious files. Additionally, searching the codebase for usage of execSync with unsanitized inputs can help identify vulnerable code. For example, you can use: `grep -r "execSync" ./lib/utils.js` to find the vulnerable function. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading codeceptjs to a version where this vulnerability is fixed (if available). If an upgrade is not possible, avoid using or calling the emptyFolder function with user-controlled input. Additionally, sanitize or escape any input passed to execSync commands to prevent command injection. Restrict permissions and isolate environments where codeceptjs runs to limit potential damage from exploitation. [1]

Useful 0 Not Useful 0