CVE-2022-25926 (published 2023-01-04T18:15Z)

Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.\r\r

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/bruno-robert/window-control
commit_details: repo_url: https://github.com/bruno-robert/window-control
author: Bruno Robert
author_date: 2023-01-02 15:16:15+01:00
msg: fix: add sanitisation to user input
repository: repo_url: https://github.com/bruno-robert/window-control
repo_name: bruno-robert/window-control
description: An npm package that provides tools to manage window focus (maybe more later)
repo_language: JavaScript
owner: bruno-robert
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,12 @@ const linuxGetWindowList = path.join(__dirname, 'linux', 'getWindowList.sh')
 const macGetWindowList = path.join(__dirname, 'mac', 'getWindowList.applescript')
 const winGetWindowList = path.join(__dirname, 'windows', 'listOpenWindows.bat')
 
+const sanitiseUserInput = (input) => {
+  let newInput = (' ' + input).slice(1)
+  newInput = newInput.replaceAll("'", "");
+  return newInput
+}
+
 /**
  * Focuses the first window of the process with the PID given
  * @param {integer} id PID to use to find the application window
@@ -63,7 +69,7 @@ const sendKeys = (id, keys, {resetFocus = false, pressEnterOnceDone = true} = {}
     keys = keys.replace('"', '\\"')
 
     if ( process.platform === 'darwin' ) {
-      exec(`osascript "${macFocusAndSendKeys}" ${id} "${keys}" ${resetFocus} ${pressEnterOnceDone}`, (error, stdout, stderr) => {
+      exec(`osascript "${macFocusAndSendKeys}" '${sanitiseUserInput(id)}' '${sanitiseUserInput(keys)}' ${resetFocus} ${pressEnterOnceDone}`, (error, stdout, stderr) => {
         if (error) reject(error)
         if (stderr) reject(stderr)
         resolve(stdout)
@@ -76,7 +82,7 @@ const sendKeys = (id, keys, {resetFocus = false, pressEnterOnceDone = true} = {}
         keys = keys + '~'
       }
 
-      exec(`${winSendKeysToWindowName} "${windowTitle}" "${keys}"`, (error, stdout, stderr) => {
+      exec(`${winSendKeysToWindowName} '${sanitiseUserInput(windowTitle)}' '${sanitiseUserInput(keys)}'`, (error, stdout, stderr) => {
         if (error) reject(error)
         if (stderr) reject(stderr)
         resolve(stdout)
@@ -86,7 +92,7 @@ const sendKeys = (id, keys, {resetFocus = false, pressEnterOnceDone = true} = {}
       // TODO: add option to reset focus on linux
       // TODO: add option to not press enter once keys have been sent
       const windowID = id // although the function calls it pid, iin this case it's a windowID
-      exec(`${sendTextToWindowWithId} ${windowID} "${keys}"`, (error, stdout, stderr) => {
+      exec(`${sendTextToWindowWithId} '${sanitiseUserInput(windowID)}' '${sanitiseUserInput(keys)}'`, (error, stdout, stderr) => {
         if (error) reject(error)
         if (stderr) reject(stderr)
         resolve(stdout)
@@ -199,4 +205,4 @@ module.exports = {
   focusWindow: focusWindow,
   sendKeys: sendKeys,
   getWindowList: getWindowList,
-}
\ No newline at end of file
+}

programming_language: JavaScript
filename: package-lock.json
change_type: ModificationType.MODIFY
diff: @@ -1,8 +1,54 @@
 {
   "name": "window-control",
-  "version": "1.4.4",
-  "lockfileVersion": 1,
+  "version": "1.4.5",
+  "lockfileVersion": 2,
   "requires": true,
+  "packages": {
+    "": {
+      "name": "window-control",
+      "version": "1.4.5",
+      "license": "MIT",
+      "dependencies": {
+        "hazardous": "^0.3.0",
+        "json5": "^2.1.1"
+      }
+    },
+    "node_modules/callsite": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/callsite/-/callsite-1.0.0.tgz",
+      "integrity": "sha1-KAOY5dZkvXQDi28JBRU+borxvCA=",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/hazardous": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/hazardous/-/hazardous-0.3.0.tgz",
+      "integrity": "sha512-VLSlBMoLTnfScKBJTycufZ2OHLO06eS3Q0mxNdHJ+egd1QLqeLitxDeGeUuoIgOqSPer+uqZCxiv43a1EVmwdg==",
+      "dependencies": {
+        "callsite": "^1.0.0"
+      }
+    },
+    "node_modules/json5": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.1.1.tgz",
+      "integrity": "sha512-l+3HXD0GEI3huGq1njuqtzYK8OYJyXMkOLtQ53pjWh89tvWS2h6l+1zMkYWqlb57+SiQodKZyvMEFb2X+KrFhQ==",
+      "dependencies": {
+        "minimist": "^1.2.0"
+      },
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
+      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q=="
+    }
+  },
   "dependencies": {
     "callsite": {
       "version": "1.0.0",

programming_language: Scala
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "window-control",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "Tools to manage window focus on mac, windows and linux",
   "main": "index.js",
   "scripts": {

programming_language: JavaScript