CVE-2022-0144
📋 TL;DR
CVE-2022-0144 is a privilege management vulnerability in shelljs where the 'exec' function could be tricked into executing commands with elevated privileges when called with specific arguments. This affects any application using vulnerable versions of shelljs, particularly Node.js applications that rely on shelljs for shell command execution. Attackers could potentially execute arbitrary commands with higher privileges than intended.
💻 Affected Systems
- shelljs
📦 What is this software?
Shelljs by Shelljs Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with elevated privileges leading to complete system compromise, data exfiltration, or lateral movement within the network.
Likely Case
Local privilege escalation allowing attackers to execute commands with higher permissions than their current user context, potentially leading to unauthorized access to sensitive resources.
If Mitigated
Limited impact due to proper input validation, least privilege principles, and network segmentation preventing command execution.
🎯 Exploit Status
Exploitation requires the ability to control arguments passed to shelljs exec function. Proof-of-concept code is publicly available in the commit references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: shelljs 0.8.5 and later
Vendor Advisory: https://github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c
Restart Required: No
Instructions:
1. Update shelljs dependency to version 0.8.5 or later. 2. Run 'npm update shelljs' or 'yarn upgrade shelljs'. 3. Test your application to ensure compatibility with the updated version. 4. Rebuild and redeploy if using bundled dependencies.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation for any user-controlled data passed to shelljs exec function
Use alternative execution methods
allReplace shelljs exec with Node.js child_process module with explicit argument handling
// Example: Use child_process.spawn instead
const { spawn } = require('child_process');
const ls = spawn('ls', ['-lh', '/usr']);
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs passed to shelljs functions
- Run applications with minimal necessary privileges and implement principle of least privilege
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list shelljs' to see installed version. If version is below 0.8.5, you are vulnerable.Check Version:
npm list shelljs | grep shelljsVerify Fix Applied:
After updating, verify shelljs version is 0.8.5 or higher using 'npm list shelljs' or check package-lock.json.📡 Detection & Monitoring
Log Indicators:
- Unexpected shell command execution with elevated privileges
- Anomalous process creation from Node.js applications
- Failed privilege escalation attempts in system logs
Network Indicators:
- Unusual outbound connections from Node.js processes
- Command and control traffic from applications using shelljs
SIEM Query:
process.name: "node" AND process.args: "shelljs" AND process.integrity_level: "high"