CVE-2020-11079 (published 2020-05-28T19:15Z)

node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/skoranga/node-dns-sync
commit_details: repo_url: https://github.com/skoranga/node-dns-sync
author: skoranga
author_date: 2020-05-19 18:48:24-07:00
msg: allowing only valid rrtypes
repository: repo_url: https://github.com/skoranga/node-dns-sync
repo_name: skoranga/node-dns-sync
description: Sync version of DNS lookup. Useful for server startup activities.
repo_language: JavaScript
owner: skoranga
file_changes: filename: .travis.yml
change_type: ModificationType.MODIFY
diff: @@ -4,3 +4,5 @@ node_js:
   - "6"
   - "8"
   - "10"
+  - "12"
+  - "14"

programming_language: CoffeeScript
filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,18 @@
-####0.2.0
- - Updating dependencies
+CHANGELOG
+==========
 
-####0.1.3
- - Added support for resolving AAAA and NS records
- - Upgrading to latest shelljs dependency
+0.2.1
+-----
+
+- Allowing only valid rrtypes as per https://nodejs.org/api/dns.html#dns_dns_resolve_hostname_rrtype_callback.
+
+0.2.0
+-----
+
+- Updating dependencies
+
+0.1.3
+-----
+
+- Added support for resolving AAAA and NS records
+- Upgrading to latest shelljs dependency

programming_language: Markdown
filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,9 @@ node-dns-sync
 
 Sync/Blocking DNS resolve. Main usecase is in node server startup.
 
-### How to Use
+How to Use
+-------
+
 ```javascript
 var dnsSync = require('dns-sync');
 

programming_language: Markdown
filename: dns-sync.js
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,20 @@ var util = require('util'),
 //source - http://stackoverflow.com/questions/106179/regular-expression-to-match-dns-hostname-or-ip-address
 var ValidHostnameRegex = new RegExp("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$");
 
+// https://nodejs.org/api/dns.html#dns_dns_resolve_hostname_rrtype_callback
+var RRecordTypes = [
+    'A',
+    'AAAA',
+    'NS',
+    'NAPTR',
+    'CNAME',
+    'SOA',
+    'SRV',
+    'PTR',
+    'MX',
+    'TXT',
+    'ANY'];
+
 function isValidHostName(hostname) {
     return ValidHostnameRegex.test(hostname);
 }
@@ -26,6 +40,10 @@ module.exports = {
             console.error('Invalid hostname:', hostname);
             return null;
         }
+        if (typeof type !== 'undefined' && RRecordTypes.indexOf(type) === -1) {
+            console.error('Invalid rrtype:', type);
+            return null;
+        }
 
         var scriptPath = path.join(__dirname, "../scripts/dns-lookup-script"),
             response,

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "dns-sync",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "dns-sync",
   "main": "index.js",
   "scripts": {

programming_language: JavaScript
filename: test.js
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 'use strict';
 
 var assert = require('assert'),
+    fs = require('fs'),
     dnsSync = require('../index');
 
 describe('dns sync', function () {
@@ -38,4 +39,12 @@ describe('dns sync', function () {
         assert.ok(ns.length >= 1);
         assert.ok(ns[0].match(/^ns[0-9]+\.google\.com$/));
     });
+
+    it('should fail to resolve if invalid record is asked', function () {
+        var rs1 = dnsSync.resolve('www.google.com', 'Test');
+        var rs2 = dnsSync.resolve('www.google.com', ' && touch test.txt');
+        assert.ok(!rs1);
+        assert.ok(!rs2);
+        assert.ok(!fs.existsSync('test.txt'));
+    });
 });

programming_language: JavaScript