CVE-2019-10801
📋 TL;DR
CVE-2019-10801 is a command injection vulnerability in the enpeem npm package that allows attackers to execute arbitrary commands on affected systems. The vulnerability occurs because user-supplied input to the 'options.dir' parameter is passed directly to the exec() function without proper sanitization. This affects any application using vulnerable versions of enpeem.
💻 Affected Systems
- enpeem
📦 What is this software?
Enpeem by Enpeem Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Local privilege escalation or arbitrary command execution within the context of the application user, potentially leading to data theft or system manipulation.
If Mitigated
Limited impact due to proper input validation, sandboxing, or least privilege configurations that restrict command execution capabilities.
🎯 Exploit Status
Exploitation requires the ability to control the 'dir' parameter, which typically requires some level of access to the application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.1
Vendor Advisory: https://github.com/balderdashy/enpeem/security/advisories
Restart Required: No
Instructions:
1. Update enpeem to version 2.2.1 or later using 'npm update enpeem'. 2. Verify the update with 'npm list enpeem'. 3. Restart any applications using enpeem.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for the 'dir' parameter to only allow expected directory paths.
Sandbox Execution
allRun the application in a sandboxed environment with restricted permissions.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-supplied parameters passed to enpeem.
- Run the application with minimal privileges and in a containerized environment to limit potential damage.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list enpeem' to see if version is 2.2.0 or earlier.Check Version:
npm list enpeemVerify Fix Applied:
Verify enpeem version is 2.2.1 or later using 'npm list enpeem'.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in application logs
- Suspicious directory paths being passed to enpeem functions
Network Indicators:
- Unexpected outbound connections from the application
- Command and control traffic patterns
SIEM Query:
Process execution logs showing unexpected commands from the Node.js application process