Command Injection in moment-timezone
Date: 2022-08
Affected: npm/moment-timezone
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Low

### Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. * if Alice uses tzdata pipeline to package moment-timezone on her own (for example via `grunt data:2014d`, where `2014d` stands for the version of the tzdata to be used from IANA's website), * and Alice let's Mallory select the version (`2014d` in our example), then Mallory can execute arbitrary commands on the machine running the grunt task, with the same privilege as the grunt task #### Am I affected? ##### Do you build custom versions of moment-timezone with grunt? If no, you're not affected. ##### Do you allow a third party to specify which particular version you want build? If yes, you're vulnerable to command injection -- third party may execute arbitrary commands on the system running grunt task with the same privileges as grunt task. ### Description #### Command Injection via grunt-zdownload.js and MITM on iana's ftp endpoint The `tasks/data-download.js` script takes in a parameter from grunt and uses it to form a command line which is then executed: ``` 6 module.exports = function (grunt) { 7 grunt.registerTask('data-download', '1. Download data from iana.org/time-zones.', function (version) { 8 version = version || 'latest'; 10 var done = this.async(), 11 src = 'ftp://ftp.iana.org/tz/tzdata-latest.tar.gz', 12 curl = path.resolve('temp/curl', version, 'data.tar.gz'), 13 dest = path.r


Mitigations:

Architectural layers (MAESTRO):