Summary
webp-converter versions before 3.0.0 may allow OS command injection when attacker-controlled file names or option strings are passed to helper functions that invoke libwebp binaries. Because these helpers use execFile with shell execution enabled, crafted input may cause arbitrary operating system commands to run with the privileges of the Node.js process.
webp-converter versions before 3.0.0 may allow OS command injection when attacker-controlled file names or option strings are passed to helper functions that invoke libwebp binaries. Because these helpers use execFile with shell execution enabled, crafted input may cause arbitrary operating system commands to run with the privileges of the Node.js process.
Affected context
The vulnerability occurs in applications using webp-converter helper functions that invoke cwebp, dwebp, gwebp, or webpmux. Risk depends on whether untrusted users can influence file names, conversion options, or other argument values before those values reach the process-execution helpers, and on the privileges available to the Node.js process.
The vulnerability occurs in applications using webp-converter helper functions that invoke cwebp, dwebp, gwebp, or webpmux. Risk depends on whether untrusted users can influence file names, conversion options, or other argument values before those values reach the process-execution helpers, and on the privileges available to the Node.js process.
Exploit preconditions
- Attack surface: Application code that calls webp-converter helpers backed by libwebp binaries
- Required access: Ability to influence file names or option strings supplied to those helper functions
- Trigger point: Construction and execution of a conversion command
- Why exploitation is possible: Shell execution is enabled, allowing shell metacharacters in attacker-controlled arguments to alter command interpretation
- Attack surface: Application code that calls webp-converter helpers backed by libwebp binaries
- Required access: Ability to influence file names or option strings supplied to those helper functions
- Trigger point: Construction and execution of a conversion command
- Why exploitation is possible: Shell execution is enabled, allowing shell metacharacters in attacker-controlled arguments to alter command interpretation
Why this happens
The underlying bug is unsafe construction of operating system commands from values that may be controlled by external users. Enabling shell interpretation for process execution causes argument data to be parsed as shell syntax rather than treated strictly as literal process arguments. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
The underlying bug is unsafe construction of operating system commands from values that may be controlled by external users. Enabling shell interpretation for process execution causes argument data to be parsed as shell syntax rather than treated strictly as literal process arguments. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- Attackers may execute arbitrary operating system commands
- The Node.js application process may be compromised
- Application data, credentials, or environment secrets could be accessed
- Files may be modified, deleted, or exfiltrated
- The host or connected services could be affected through lateral movement
- Attackers may execute arbitrary operating system commands
- The Node.js application process may be compromised
- Application data, credentials, or environment secrets could be accessed
- Files may be modified, deleted, or exfiltrated
- The host or connected services could be affected through lateral movement
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from process execution and treating all file names and options as untrusted data.
Common defensive patterns include:
- Invoking binaries without a shell and passing arguments through structured argument arrays
- Allowing only explicitly supported conversion options and rejecting unexpected values
- Applying strict validation to file names, paths, and option strings
- Separating user-controlled files from executable or sensitive directories
- Running the Node.js process with the minimum filesystem, network, and operating-system privileges
- Using isolated workers or sandboxing where conversion inputs are exposed to untrusted users
Mitigation generally focuses on removing shell interpretation from process execution and treating all file names and options as untrusted data.
Common defensive patterns include:
- Invoking binaries without a shell and passing arguments through structured argument arrays
- Allowing only explicitly supported conversion options and rejecting unexpected values
- Applying strict validation to file names, paths, and option strings
- Separating user-controlled files from executable or sensitive directories
- Running the Node.js process with the minimum filesystem, network, and operating-system privileges
- Using isolated workers or sandboxing where conversion inputs are exposed to untrusted users
How teams detect issues like this
Detection can combine static analysis, code review, runtime monitoring, and policy enforcement.
- Search for process-execution APIs used with shell execution enabled, especially where arguments derive from request data, uploaded file names, or user options.
- Review calls to conversion helpers for direct concatenation, interpolation, or insufficient validation of command arguments.
- Use dependency and source scanning rules for command-injection patterns in JavaScript and Node.js code.
- Monitor child-process creation, unexpected shell launches, unusual converter arguments, and access to sensitive files.
- Enforce application security policies that prohibit shell-based execution for untrusted input unless a narrowly reviewed exception exists.
Detection can combine static analysis, code review, runtime monitoring, and policy enforcement.
- Search for process-execution APIs used with shell execution enabled, especially where arguments derive from request data, uploaded file names, or user options.
- Review calls to conversion helpers for direct concatenation, interpolation, or insufficient validation of command arguments.
- Use dependency and source scanning rules for command-injection patterns in JavaScript and Node.js code.
- Monitor child-process creation, unexpected shell launches, unusual converter arguments, and access to sensitive files.
- Enforce application security policies that prohibit shell-based execution for untrusted input unless a narrowly reviewed exception exists.
