OS Command Injection in Node Convert Library

Executive Summary

This vulnerability is an OS command injection flaw in the @enmaso/node-convert package up to version 1.0.0. It occurs in the convert.js file where unsanitized filepath and convertTo arguments allow attackers to inject shell commands. These commands are executed via Node.js child_process.exec() with the privileges of the running process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running @enmaso/node-convert through version 1.0.0 for unsanitized filepath or convertTo arguments passed to convert.js. Check for unusual child_process.exec() calls in Node.js applications using this library. Look for unexpected shell command execution patterns or ImageMagick command injections in logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run arbitrary commands on your system with the same permissions as the Node.js process. This could lead to data theft, system compromise, or unauthorized actions depending on the application's environment and privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance violations, fines, or legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update @enmaso/node-convert to a patched version if available. If not, remove the library from your system. Review and sanitize all inputs passed to convert.js, especially filepath and convertTo arguments. Implement input validation to prevent shell metacharacters or quotes from being passed to child_process.exec().

Useful 0 Not Useful 0