CVE-2021-34084
📋 TL;DR
This CVE describes an OS command injection vulnerability in the Turistforeningen node-s3-uploader npm package for Node.js. Attackers can execute arbitrary commands on the server by exploiting the metadata() function. Any Node.js application using vulnerable versions of this package is affected.
💻 Affected Systems
- Turistforeningen node-s3-uploader
📦 What is this software?
S3 Uploader by S3 Uploader Project
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary commands with the privileges of the Node.js process, potentially leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Remote code execution leading to data exfiltration, cryptocurrency mining, or lateral movement within the network.
If Mitigated
Limited impact due to proper input validation, sandboxing, or least-privilege execution contexts.
🎯 Exploit Status
Exploitation requires the attacker to control input to the metadata() function. Public proof-of-concept exists in advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.4
Vendor Advisory: https://advisory.checkmarx.net/advisory/CX-2021-4776
Restart Required: Yes
Instructions:
1. Update package.json to specify node-s3-uploader version 2.0.4 or higher. 2. Run 'npm update node-s3-uploader'. 3. Restart the Node.js application.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation and sanitization for all user inputs passed to the metadata() function.
Remove or disable vulnerable function
allIf metadata() function is not essential, remove or disable its usage in the application.
🧯 If You Can't Patch
- Implement network segmentation to isolate affected systems from critical assets.
- Deploy application-level firewalls (WAF) with command injection detection rules.
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/node-s3-uploader/package.json for version <=2.0.3.Check Version:
npm list node-s3-uploader | grep node-s3-uploaderVerify Fix Applied:
Verify package.json specifies version >=2.0.4 and check installed version with 'npm list node-s3-uploader'.📡 Detection & Monitoring
Log Indicators:
- Unusual process executions from Node.js, unexpected command-line arguments, failed command executions
Network Indicators:
- Outbound connections to suspicious IPs from Node.js process, unexpected data exfiltration
SIEM Query:
process.name:node AND cmdline:*metadata* AND (cmdline:*;* OR cmdline:*&* OR cmdline:*|*)