Fix command injection in WebAuth.js open() — replace exec() with execFile() #6089

Author: Unitech

CHANGELOG.md

@@ -19,6 +19,7 @@
 - Drop auto source map file detection in Common.prepareAppConf
 - Fix HttpInterface env stripping never executing (WEB_STRIP_ENV_VARS) #6089
 - Fix prototype pollution in Configuration.set/unset via __proto__ key traversal #6089
+- Fix command injection in WebAuth.js open() — replace exec() with execFile() #6089
 
 ## 6.0.14
 

lib/API/pm2-plus/auth-strategies/WebAuth.js

@@ -6,7 +6,7 @@ const cst = require('../../../../constants.js');
 const AuthStrategy = require('@pm2/js-api/src/auth_strategies/strategy')
 const http = require('http')
 const fs = require('fs')
-const exec = require('child_process').exec
+const { execFile } = require('child_process')
 const tryEach = require('async/tryEach');
 
 module.exports = class WebStrategy extends AuthStrategy {
@@ -153,34 +153,43 @@ module.exports = class WebStrategy extends AuthStrategy {
   }
 
   open (target, appName, callback) {
-    let opener
-    const escape = function (s) {
-      return s.replace(/"/g, '\\"')
-    }
-
     if (typeof (appName) === 'function') {
       callback = appName
       appName = null
     }
 
+    let cmd
+    let args = []
+
     switch (process.platform) {
       case 'darwin': {
-        opener = appName ? `open -a "${escape(appName)}"` : `open`
+        cmd = 'open'
+        if (appName) args.push('-a', appName)
+        args.push(target)
         break
       }
       case 'win32': {
-        opener = appName ? `start "" ${escape(appName)}"` : `start ""`
+        cmd = 'cmd'
+        args = ['/c', 'start', '""']
+        if (appName) args.push(appName)
+        args.push(target)
         break
       }
       default: {
-        opener = appName ? escape(appName) : `xdg-open`
+        cmd = appName || 'xdg-open'
+        args.push(target)
         break
       }
     }
 
     if (process.env.SUDO_USER) {
-      opener = 'sudo -u ' + process.env.SUDO_USER + ' ' + opener
+      if (!/^[a-zA-Z0-9._-]+$/.test(process.env.SUDO_USER)) {
+        return callback && callback(new Error('Invalid SUDO_USER'))
+      }
+      args = ['-u', process.env.SUDO_USER, cmd].concat(args)
+      cmd = 'sudo'
     }
-    return exec(`${opener} "${escape(target)}"`, callback)
+
+    return execFile(cmd, args, callback)
   }
 }