huntr.dev - Code Injection

[huntr-helper]

This issue has been generated on-behalf of Mik317 (https://huntr.dev/app/users/Mik317)

Vulnerability Description

Affected versions execute arbitrary commands remotely inside the victim's PC. The issue occurs because user input is formatted inside a command that will be executed without any checks. The spawn function receives the _executableShell variable, which is the /bin/sh command. This could result in any command, even if the function is written correctly, leading to RCE.

The issue arises here:

https://github.com/mattijs/node-rsync/blob/master/rsync.js#L506

Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

[AdamGold]

@mattijs
Hi! My name is Adam and I am part of the Snyk Security team. We have POCd this vulnerability, and we have tried contacting you through emails to no avail. We would like to discuss the nature of this issue.
We'd appreciate if a contributor/maintainer could get in touch with us via the vulnerability disclosure form or email us at report@snyk.io.
Thanks!

[JamieSlome]

Hey @AdamGold - we have actually sourced a fix (#70) that we are waiting to get approved by @mattijs 🍰

Let us know if we can be of any help 😄