CVE-2020-7602
📋 TL;DR
CVE-2020-7602 is a command injection vulnerability in node-prompt-here that allows attackers to execute arbitrary commands on affected systems. The vulnerability exists because user-controlled input is passed directly to execSync() without sanitization. This affects any application using vulnerable versions of the node-prompt-here package.
💻 Affected Systems
- node-prompt-here
📦 What is this software?
Node Prompt Here by Node Prompt Here Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with complete control over the host, allowing data theft, ransomware deployment, or use as a foothold for lateral movement.
Likely Case
Remote code execution leading to application compromise, data exfiltration, and potential privilege escalation.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, though the vulnerability still exists.
🎯 Exploit Status
Simple command injection with publicly available proof-of-concept
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.2
Vendor Advisory: https://snyk.io/vuln/SNYK-JS-NODEPROMPTHERE-560115
Restart Required: Yes
Instructions:
1. Update node-prompt-here to version 1.0.2 or later using npm update node-prompt-here
2. Restart any applications using this package
3. Verify the update with npm list node-prompt-here
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for any user-controlled parameters passed to the getDevices() function
Package Removal
allRemove node-prompt-here if not essential for application functionality
npm uninstall node-prompt-here
🧯 If You Can't Patch
- Implement network segmentation to isolate affected systems
- Deploy application-level firewalls to monitor and block suspicious command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list node-prompt-here to see if version ≤1.0.1 is installedCheck Version:
npm list node-prompt-here | grep node-prompt-hereVerify Fix Applied:
Verify node-prompt-here version is 1.0.2 or higher using npm list node-prompt-here📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from the node process
- Suspicious child process spawns with user-controlled arguments
Network Indicators:
- Unexpected outbound connections from the node application
- Command and control traffic patterns
SIEM Query:
process.name:node AND process.args:*execSync* AND process.args:*user_input*