Security Fix for Command Injection - huntr.dev

index.js

@@ -2,7 +2,8 @@
 
 var fs		= require('fs');
 var http	= require('http');
-var exec	= require('child_process').exec;
+var execFile	= require('child_process').execFile;
+var spawn	= require('child_process').spawn;
 
 var serialNumber = function (cb, cmdPrefix) {
 	var delimiter = ': ';
@@ -45,6 +46,52 @@ var serialNumber = function (cb, cmdPrefix) {
 		return result;
 	};
 
+	var execCmd = function (cmdPrefix, cmd, val, callback) {
+		if (cmdPrefix.endsWith(' ')) {	// If ends with space is treated as a comand, like sudo
+			var cmdArgs = cmd;
+			cmd = cmdPrefix.trim();
+		} else {							// Else path, apend
+			var cmdArgs = cmd.slice(1);
+			cmd = cmdPrefix + cmd[0];
+		}
+		if (process.platform == 'win32') {
+			args.push(val);
+			execFile(cmd, cmdArgs, (error, stdout) => {
+				if(callback) callback(error, stdout);
+			});
+		} else { // If not win32 use spawn for grep
+			let stdout = '';
+			let stderr = '';
+			const spCmd1 = spawn(cmd, cmdArgs);
+			const spCmd2 = spawn('grep', [val]);
+
+			spCmd1.stdout.on('data', (data) => {
+				spCmd2.stdin.write(data);
+			});
+			spCmd1.stderr.on('data', (data) => {
+				stderr += data;
+			});
+			spCmd1.on('close', (code) => {
+				if (code !== 0) {
+					console.error(`${cmd1} process exited with code ${code}`);
+				}
+				spCmd2.stdin.end();
+			});
+			spCmd2.stdout.on('data', (data) => {
+				stdout += data.toString();
+			});
+			spCmd2.stderr.on('data', (data) => {
+				stderr+= data;
+			});
+			spCmd2.on('close', (code) => {
+			if (code !== 0) {
+				console.error(`${cmd2} process exited with code ${code}`);
+			}
+				if(callback) callback(stderr, stdout);
+  			});
+		}
+	}
+
 	var attemptEC2 = function (failCb) {
 		var data = '';
 		var failHandler = function () {
@@ -77,37 +124,37 @@ var serialNumber = function (cb, cmdPrefix) {
 	case 'win32':
 		delimiter = '\r\n';
 		vals[0] = 'IdentifyingNumber';
-		cmd = 'wmic csproduct get ';
+		cmd = ['wmic', 'csproduct', 'get'];
 		break;
 
 	case 'darwin':
-		cmd = 'system_profiler SPHardwareDataType | grep ';
+		cmd = ['system_profiler', 'SPHardwareDataType'];
 		break;
 
 	case 'linux':
 		if (process.arch === 'arm') {
 			vals[1] = 'Serial';
-			cmd = 'cat /proc/cpuinfo | grep ';
+			cmd = ['cat', '/proc/cpuinfo'];
 
 		} else {
-			cmd = 'dmidecode -t system | grep ';
+			cmd = ['dmidecode', '-t', 'system'];
 		}
 		break;
 
 	case 'freebsd':
-		cmd = 'dmidecode -t system | grep ';
+		cmd = ['dmidecode', '-t', 'system'];
 		break;
 	}
 
 	if (!cmd) return cb(new Error('Cannot provide serial number for ' + process.platform));
 
 	if (serialNumber.preferUUID) vals.reverse();
 
-	exec(cmdPrefix + cmd + vals[0], function (error, stdout) {
+	execCmd(cmdPrefix, cmd, vals[0], (error, stdout) => {
 		if (error || parseResult(stdout).length > 1) {
 			stdoutHandler(error, stdout);
 		} else {
-			exec(cmdPrefix + cmd + vals[1], stdoutHandler);
+			execCmd(cmdPrefix, cmd, vals[1], stdoutHandler);
 		}
 	});
 };