CVE-2023-29566
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of huedawn-tesseract or dawnsparks-node-tesseract. The RCE occurs via insecure use of the child_process function, potentially giving attackers full control of affected systems. Anyone using these Node.js packages for OCR functionality is affected.
💻 Affected Systems
- huedawn-tesseract
- dawnsparks-node-tesseract
📦 What is this software?
Dawnsparks Node Tesseract by Dawnsparks Node Tesseract Project
Dawnsparks Node Tesseract by Dawnsparks Node Tesseract Project
Huedawn Tesseract by Huedawn Tesseract Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal data, pivot to other systems, or establish persistent backdoors.
Likely Case
Server takeover leading to data theft, cryptocurrency mining, or use in botnets for DDoS attacks.
If Mitigated
Limited impact if proper network segmentation, least privilege, and monitoring are in place.
🎯 Exploit Status
The vulnerability is in publicly available packages with documented exploitation methods.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: dawnsparks-node-tesseract 0.4.2+
Vendor Advisory: https://github.com/rona-dinihari/dawnsparks-node-tesseract/commit/81d1664f0b9fe521534acfae1d5b9c40127b36c1
Restart Required: Yes
Instructions:
1. Update package.json to use dawnsparks-node-tesseract >=0.4.2. 2. Run 'npm update dawnsparks-node-tesseract'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Remove vulnerable packages
allUninstall the vulnerable packages if OCR functionality is not essential
npm uninstall huedawn-tesseract dawnsparks-node-tesseract
Network isolation
allRestrict network access to affected applications
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs
- Run the application with minimal privileges and in a containerized environment
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list huedawn-tesseract dawnsparks-node-tesseract'Check Version:
npm list dawnsparks-node-tesseract huedawn-tesseractVerify Fix Applied:
Verify installed version is dawnsparks-node-tesseract >=0.4.2 and huedawn-tesseract is not installed📡 Detection & Monitoring
Log Indicators:
- Unusual child_process spawns
- Suspicious command execution patterns
- Unexpected network connections from Node.js processes
Network Indicators:
- Outbound connections to suspicious IPs from Node.js applications
- Unexpected data exfiltration
SIEM Query:
process.name:node AND (process.args:*child_process* OR process.args:*spawn*)🔗 References
- https://github.com/omnitaint/Vulnerability-Reports/blob/ec3645003c7f8996459b5b24c722474adc2d599f/reports/dawnsparks-node-tesseract/report.md
- https://github.com/rona-dinihari/dawnsparks-node-tesseract
- https://github.com/rona-dinihari/dawnsparks-node-tesseract/commit/81d1664f0b9fe521534acfae1d5b9c40127b36c1
- https://www.npmjs.com/package/dawnsparks-node-tesseract
- https://github.com/omnitaint/Vulnerability-Reports/blob/ec3645003c7f8996459b5b24c722474adc2d599f/reports/dawnsparks-node-tesseract/report.md
- https://github.com/rona-dinihari/dawnsparks-node-tesseract
- https://github.com/rona-dinihari/dawnsparks-node-tesseract/commit/81d1664f0b9fe521534acfae1d5b9c40127b36c1
- https://www.npmjs.com/package/dawnsparks-node-tesseract
