CVE-2021-42740
📋 TL;DR
The shell-quote package for Node.js has a command injection vulnerability due to incorrect regex character class {A-z] instead of {A-Za-z] for Windows drive letters. This allows attackers to inject shell metacharacters when output is passed to exec(), potentially leading to arbitrary command execution. Any Node.js application using shell-quote before version 1.7.3 is affected.
💻 Affected Systems
- shell-quote Node.js package
📦 What is this software?
Shell Quote by Shell Quote Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, data exfiltration, and lateral movement within the environment.
Likely Case
Arbitrary command execution with the privileges of the Node.js process, potentially leading to data theft or service disruption.
If Mitigated
Limited impact if proper input validation, sandboxing, and least privilege principles are implemented.
🎯 Exploit Status
Exploitation requires user-controlled input to be processed by vulnerable shell-quote and passed to exec(). The vulnerability is well-documented with public proof-of-concept examples.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.3 and later
Vendor Advisory: https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173
Restart Required: Yes
Instructions:
1. Update package.json to require shell-quote version 1.7.3 or higher. 2. Run 'npm update shell-quote' or 'yarn upgrade shell-quote'. 3. Restart all Node.js applications using the package.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to reject any input containing shell metacharacters before passing to shell-quote.
Use alternative quoting methods
allReplace shell-quote with alternative safe quoting libraries or built-in Node.js child_process.spawn with proper argument handling.
🧯 If You Can't Patch
- Implement strict input validation to reject any characters between ASCII 91-96 (including backtick).
- Run Node.js processes with minimal privileges and in isolated containers or sandboxes.
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/shell-quote/package.json for version number less than 1.7.3.Check Version:
npm list shell-quote | grep shell-quoteVerify Fix Applied:
Verify shell-quote version is 1.7.3 or higher in package.json and test with known malicious inputs containing backticks or other metacharacters.📡 Detection & Monitoring
Log Indicators:
- Unexpected shell commands in application logs
- Process spawning with unusual arguments
- Error messages containing shell metacharacters
Network Indicators:
- Unexpected outbound connections from Node.js processes
- Data exfiltration patterns
SIEM Query:
process.name:node AND cmdline:*backtick* OR cmdline:*`*🔗 References
- https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173
- https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe
- https://www.npmjs.com/package/shell-quote
- https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173
- https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe
- https://www.npmjs.com/package/shell-quote
