Summary
Stills contains an OS command injection vulnerability in processing workflows that pass media file paths to external utilities. An attacker who can supply or influence a crafted media filename may execute shell commands with the privileges of the Node.js process when ffmpeg, ffprobe, gifsicle, or convert is invoked.
Stills contains an OS command injection vulnerability in processing workflows that pass media file paths to external utilities. An attacker who can supply or influence a crafted media filename may execute shell commands with the privileges of the Node.js process when ffmpeg, ffprobe, gifsicle, or convert is invoked.
Affected context
The issue occurs in Stills deployments that process attacker-influenced media paths through external command-line tools. Risk is present when filenames are incorporated into shell commands without robust argument separation or neutralization, particularly where untrusted users can upload, rename, or otherwise control media files.
The issue occurs in Stills deployments that process attacker-influenced media paths through external command-line tools. Risk is present when filenames are incorporated into shell commands without robust argument separation or neutralization, particularly where untrusted users can upload, rename, or otherwise control media files.
Exploit preconditions
- Attack surface: Media-processing functionality that invokes ffmpeg, ffprobe, gifsicle, or convert
- Required access: Ability to provide or influence a media file path or filename processed by Stills
- Trigger point: Execution of an external media utility using the attacker-controlled path
- Why exploitation is possible: Shell metacharacters in the path may be interpreted as command syntax instead of remaining data
- Attack surface: Media-processing functionality that invokes ffmpeg, ffprobe, gifsicle, or convert
- Required access: Ability to provide or influence a media file path or filename processed by Stills
- Trigger point: Execution of an external media utility using the attacker-controlled path
- Why exploitation is possible: Shell metacharacters in the path may be interpreted as command syntax instead of remaining data
Why this happens
The vulnerability results from constructing or invoking shell commands with media paths that are not safely separated from command syntax. Shell expansion constructs such as command substitution can cause attacker-controlled filename content to be executed by the operating system. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, where untrusted input reaches a command interpreter without adequate protection.
The vulnerability results from constructing or invoking shell commands with media paths that are not safely separated from command syntax. Shell expansion constructs such as command substitution can cause attacker-controlled filename content to be executed by the operating system. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, where untrusted input reaches a command interpreter without adequate protection.
Potential impact
- Execution of arbitrary operating system commands
- Compromise of the Stills application process
- Access to files and environment data available to Node.js
- Modification or deletion of application data
- Potential credential theft, persistence, or lateral movement
- Execution of arbitrary operating system commands
- Compromise of the Stills application process
- Access to files and environment data available to Node.js
- Modification or deletion of application data
- Potential credential theft, persistence, or lateral movement
General mitigation guidance
Mitigation generally focuses on ensuring that media paths remain data throughout the processing pipeline.
Common defensive patterns include:
- Invoke utilities directly with structured argument arrays rather than through a shell
- Apply strict path handling and reject unexpected control characters or shell metacharacters
- Resolve paths against controlled directories and prevent unintended traversal
- Use allowlisted utility options and avoid dynamically assembled command strings
- Run media-processing workers with least privilege and restricted filesystem and network access
- Treat uploaded filenames and metadata as untrusted regardless of their source
Mitigation generally focuses on ensuring that media paths remain data throughout the processing pipeline.
Common defensive patterns include:
- Invoke utilities directly with structured argument arrays rather than through a shell
- Apply strict path handling and reject unexpected control characters or shell metacharacters
- Resolve paths against controlled directories and prevent unintended traversal
- Use allowlisted utility options and avoid dynamically assembled command strings
- Run media-processing workers with least privilege and restricted filesystem and network access
- Treat uploaded filenames and metadata as untrusted regardless of their source
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving shell execution APIs, command-string concatenation, or interpolated media paths
- Code review signals such as template literals or string concatenation passed to child-process or shell APIs
- Tests using filenames containing shell metacharacters to verify that they remain literal arguments
- Runtime monitoring for unexpected child processes, command interpreters, or unusual utility arguments
- Policy enforcement requiring direct process execution with separated arguments and approved executable paths
Automated security and code-review tools may help identify unsafe command construction patterns.
Organizations can look for:
- Static analysis findings involving shell execution APIs, command-string concatenation, or interpolated media paths
- Code review signals such as template literals or string concatenation passed to child-process or shell APIs
- Tests using filenames containing shell metacharacters to verify that they remain literal arguments
- Runtime monitoring for unexpected child processes, command interpreters, or unusual utility arguments
- Policy enforcement requiring direct process execution with separated arguments and approved executable paths
Automated security and code-review tools may help identify unsafe command construction patterns.
