CVE-2020-8298
📋 TL;DR
CVE-2020-8298 is a command injection vulnerability in the fs-path Node.js module that allows attackers to execute arbitrary commands on the host system. The vulnerability affects applications using fs-path's copy, copySync, remove, and removeSync methods with user-controlled input. Any Node.js application using vulnerable versions of fs-path is potentially affected.
💻 Affected Systems
- fs-path Node.js module
📦 What is this software?
Fs Path by Fs Path Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing remote code execution, data theft, lateral movement, and complete control of the affected server.
Likely Case
Arbitrary command execution leading to data exfiltration, service disruption, or installation of backdoors/malware.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only affecting isolated application components.
🎯 Exploit Status
Exploitation is straightforward when user input reaches vulnerable methods. Public proof-of-concept exists in HackerOne report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.25 and later
Vendor Advisory: https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7
Restart Required: Yes
Instructions:
1. Update package.json to require fs-path version 0.0.25 or higher. 2. Run 'npm update fs-path' or 'yarn upgrade fs-path'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation and sanitization for all user inputs before passing to fs-path methods
Sandbox execution
linuxRun Node.js application in a container or sandbox with limited privileges
docker run --read-only --cap-drop=ALL -u nobody node:alpine
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all parameters passed to fs-path methods
- Remove or disable functionality that uses vulnerable fs-path methods with user-controlled input
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for fs-path version. If version is below 0.0.25 and application uses copy/copySync/remove/removeSync with user input, it's vulnerable.Check Version:
npm list fs-path | grep fs-path OR cat package.json | grep fs-pathVerify Fix Applied:
Verify fs-path version is 0.0.25 or higher in package.json and that npm/yarn has installed the updated version.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns
- Suspicious file operations from Node.js processes
- Error logs showing command injection attempts
Network Indicators:
- Unexpected outbound connections from Node.js application
- Data exfiltration patterns
SIEM Query:
process.name:node AND (cmdline:*copy* OR cmdline:*remove*) AND cmdline:*;* OR cmdline:*|* OR cmdline:*&*🔗 References
- https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7
- https://github.com/pillys/fs-path/pull/6
- https://hackerone.com/reports/324491
- https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7
- https://github.com/pillys/fs-path/pull/6
- https://hackerone.com/reports/324491
