CVE-2021-23376
📋 TL;DR
CVE-2021-23376 is a critical command injection vulnerability in ffmpegdotjs that allows attackers to execute arbitrary commands on the host system. This affects all versions of the ffmpegdotjs package when untrusted user input is passed to the trimvideo function. Any application using this vulnerable package is at risk of complete system compromise.
💻 Affected Systems
- ffmpegdotjs
📦 What is this software?
Ffmpegdotjs by Ffmpegdotjs Project
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/administrator privileges, data exfiltration, ransomware deployment, or complete system destruction.
Likely Case
Attacker executes commands with the same privileges as the Node.js process, potentially accessing sensitive data, installing malware, or pivoting to other systems.
If Mitigated
Limited impact if input validation and proper sandboxing are implemented, potentially restricting damage to the application's context.
🎯 Exploit Status
Simple command injection via unsanitized input to child_process.exec. Exploitation requires the trimvideo function to be called with attacker-controlled data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://github.com/TRomesh/ffmpegdotjs/security/advisories
Restart Required: No
Instructions:
1. Remove ffmpegdotjs from your project. 2. Use alternative video processing libraries with proper security controls. 3. Update package.json to remove ffmpegdotjs dependency.
🔧 Temporary Workarounds
Input Sanitization Wrapper
allImplement strict input validation and sanitization before passing data to trimvideo function
// Example: Validate input contains only safe characters
const safeInput = userInput.replace(/[^a-zA-Z0-9\s\-\._]/g, '');
Replace child_process.exec with child_process.spawn
allUse spawn with explicit arguments instead of exec to prevent command injection
// Replace: exec('ffmpeg ' + userInput)
// With: spawn('ffmpeg', [userInput])
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs passed to trimvideo function
- Run the Node.js application with minimal privileges and in a containerized/sandboxed environment
🔍 How to Verify
Check if Vulnerable:
Check package.json for ffmpegdotjs dependency: grep -r 'ffmpegdotjs' package.jsonCheck Version:
npm list ffmpegdotjsVerify Fix Applied:
Verify ffmpegdotjs is removed from package.json and node_modules directory📡 Detection & Monitoring
Log Indicators:
- Unusual child process executions from Node.js
- Suspicious command-line arguments to ffmpeg
- Multiple failed trimvideo function calls
Network Indicators:
- Outbound connections from Node.js process to unexpected destinations
- Data exfiltration patterns
SIEM Query:
process.name:node AND child_process.name:ffmpeg AND command_line:*;* OR command_line:*&* OR command_line:*|*