CVE-2019-10061
📋 TL;DR
CVE-2019-10061 is a command injection vulnerability in node-opencv's utils/find-opencv.js script that allows attackers to execute arbitrary system commands by manipulating user input. This affects all users of node-opencv versions prior to 6.1.0 who use the vulnerable script. The high CVSS score of 9.8 reflects the potential for complete system compromise.
💻 Affected Systems
- node-opencv (OpenCV bindings for Node.js)
📦 What is this software?
Node Opencv by Node Opencv Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root/admin privileges, data exfiltration, ransomware deployment, or use as a pivot point for lateral movement.
Likely Case
Arbitrary command execution with the privileges of the Node.js process, potentially leading to data theft, service disruption, or installation of backdoors.
If Mitigated
Limited impact if the vulnerable script is not used or if input validation prevents exploitation, though the vulnerability remains present.
🎯 Exploit Status
Exploitation requires the ability to control input to the vulnerable script, which could occur through various application entry points.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.0 and later
Vendor Advisory: https://www.npmjs.com/advisories/789
Restart Required: Yes
Instructions:
1. Update node-opencv to version 6.1.0 or later using npm update opencv. 2. Restart any Node.js applications using the library. 3. Verify the update with npm list opencv.
🔧 Temporary Workarounds
Input Validation/Sanitization
allImplement strict input validation and sanitization for any user input passed to the find-opencv.js script.
Script Removal/Restriction
linuxRemove or restrict execution of the vulnerable utils/find-opencv.js script if not required.
rm -f node_modules/opencv/utils/find-opencv.js
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs
- Run Node.js applications with minimal privileges and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check if node-opencv version is below 6.1.0 using npm list opencv or check package.json.Check Version:
npm list opencv | grep opencvVerify Fix Applied:
Confirm node-opencv version is 6.1.0 or higher and that the utils/find-opencv.js file contains proper input validation.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from Node.js processes
- Suspicious child process spawning
Network Indicators:
- Unexpected outbound connections from Node.js applications
SIEM Query:
process.name:node AND (process.args:*find-opencv* OR process.args:*cmd* OR process.args:*sh*)🔗 References
- https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b
- https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563
- https://www.npmjs.com/advisories/789
- https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b
- https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563
- https://www.npmjs.com/advisories/789
