ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.

Affected: npm: @apostrophecms/cli

Summary

The @apostrophecms/cli package contains a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system.

━━━━━━━━━━━━━━━━━━━━━━

Details

Vulnerable file: lib/commands/create.js Location: Line 186

The CLI collects a password using an interactive prompt and passes it directly into a shell command.

Vulnerable code:

const response = await prompts({ type: 'password', name: 'pw', message: '🔏 Please enter a password:' });

exec(echo "${response.pw}" | ${createUserCommand});

The value of response.pw is not validated, sanitized, or escaped before being used in exec().

This allows shell metacharacters such as ;, &&, and $() to break out of the intended command and execute arbitrary commands.

━━━━━━━━━━━━━━━━━━━━━━

Steps to Reproduce

1) Install the CLI npm install -g @apostrophecms/cli 2) Create a new project mkdir testproject && cd testproject apos create mysite 3)When prompted for the admin password, enter "; id > /tmp/apos_rce_proof.txt; echo " 4)Verify command execution cat /tmp/apos_rce_proof.txt

━━━━━━━━━━━━━━━━━━━━━━

Proof of Concept Output

uid=1000(vboxuser) gid=1000(vboxuser) groups=1000(vboxuser),27(sudo),984(docker)

This confirms arbitrary command execution with the privileges of the user running the CLI.

━━━━━━━━━━━━━━━━━━━━━━

Impac…