CVE-2021-23352
📋 TL;DR
CVE-2021-23352 is a command injection vulnerability in the madge package that allows attackers to execute arbitrary commands on the host system. This occurs when user-controlled input is passed to the graphVizPath option parameter, which gets executed via childprocess.exec. Anyone using madge versions before 4.0.1 with untrusted input is affected.
💻 Affected Systems
- madge
📦 What is this software?
Madge by Madge Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Local privilege escalation or execution of arbitrary commands within the application context, potentially leading to lateral movement.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only affecting the application's own data.
🎯 Exploit Status
Exploitation requires the ability to control the graphVizPath parameter. Public proof-of-concept demonstrates command injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.1
Vendor Advisory: https://github.com/pahen/madge/security/advisories/GHSA-5q88-cjfq-g2mh
Restart Required: No
Instructions:
1. Update madge package to version 4.0.1 or later using npm update madge. 2. Verify the update with npm list madge. 3. Test application functionality with the updated version.
🔧 Temporary Workarounds
Input validation and sanitization
allValidate and sanitize all user input passed to graphVizPath parameter before processing.
Implement input validation in application code to restrict graphVizPath to safe values
Use safe exec functions
allReplace childprocess.exec with childprocess.execFile or spawn with proper argument handling.
Modify lib/graph.js to use execFile instead of exec
🧯 If You Can't Patch
- Implement strict input validation for graphVizPath parameter to only allow trusted, predefined paths.
- Run madge in a sandboxed environment with minimal privileges and network access.
🔍 How to Verify
Check if Vulnerable:
Check package.json for madge version <4.0.1 or run npm list madge and verify version.Check Version:
npm list madge | grep madgeVerify Fix Applied:
Confirm madge version is 4.0.1 or higher using npm list madge and test that custom graphVizPath no longer executes arbitrary commands.📡 Detection & Monitoring
Log Indicators:
- Unusual child process executions from Node.js applications
- Commands with unexpected arguments in process logs
Network Indicators:
- Unexpected outbound connections from development or build systems
SIEM Query:
process.name:node AND process.args:*graphVizPath* AND process.parent.name:node🔗 References
- https://github.com/pahen/madge/blob/master/lib/graph.js%23L27
- https://github.com/pahen/madge/commit/da5cbc9ab30372d687fa7c324b22af7ffa5c6332
- https://snyk.io/vuln/SNYK-JS-MADGE-1082875
- https://github.com/pahen/madge/blob/master/lib/graph.js%23L27
- https://github.com/pahen/madge/commit/da5cbc9ab30372d687fa7c324b22af7ffa5c6332
- https://snyk.io/vuln/SNYK-JS-MADGE-1082875
