CVE-2025-57285
📋 TL;DR
CVE-2025-57285 is a critical command injection vulnerability in codeceptjs 3.7.3 that allows attackers to execute arbitrary commands on the host system. The vulnerability exists in the emptyFolder function where user-controlled input is directly passed to execSync without sanitization. This affects any application using the vulnerable codeceptjs version.
💻 Affected Systems
- codeceptjs
📦 What is this software?
Codeceptjs by Codecept
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, data exfiltration, lateral movement, and persistence establishment.
Likely Case
Arbitrary command execution leading to data theft, service disruption, or deployment of malware.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented.
🎯 Exploit Status
Exploitation requires control over the directoryPath parameter passed to emptyFolder function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.4 or later
Vendor Advisory: https://www.npmjs.com/package/codeceptjs
Restart Required: Yes
Instructions:
1. Update package.json to require codeceptjs >=3.7.4
2. Run 'npm update codeceptjs'
3. Restart all affected applications
4. Test functionality after update
🔧 Temporary Workarounds
Input Validation Wrapper
allImplement strict input validation for directoryPath parameter before passing to emptyFolder
// Validate directoryPath contains only safe characters
const safePath = directoryPath.replace(/[^a-zA-Z0-9_\-\.\/]/g, '')
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-controlled parameters
- Run codeceptjs in a sandboxed environment with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check package.json for codeceptjs version 3.7.3 or run 'npm list codeceptjs'Check Version:
npm list codeceptjs | grep codeceptjsVerify Fix Applied:
Verify codeceptjs version is 3.7.4 or later using 'npm list codeceptjs'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns
- Suspicious directory paths in logs
- Unexpected child process spawns
Network Indicators:
- Unexpected outbound connections from codeceptjs processes
SIEM Query:
process.name:node AND cmdline:*codeceptjs* AND (cmdline:*execSync* OR cmdline:*child_process*)