| 제목 | jishi node-sonos-http-api 3776f0e (Mar 22, 2025) OS Command Injection |
|---|
| 설명 | Remote Code Execution via OS Command Injection in Text‑to‑Speech Handler
Code reference: https://github.com/jishi/node-sonos-http-api/blob/3776f0ee2261c924c7b7204de121a38100a08ca7/lib/tts-providers/mac-os.js#L55-L64
Maintainer report: https://github.com/jishi/node-sonos-http-api/issues/915
vulnerability in the macOS TTS provider. In lib/tts-providers/mac-
os.js (current master, commit 3776f0e from 2025‑03‑22), user‑supplied
input from the /say endpoint is interpolated into shell command
strings passed to child_process.exec() without sanitization. An
attacker can inject arbitrary shell commands by crafting malicious
input in the phrase parameter, achieving RCE with the privileges of
55–62, with execution at line 64.
var execCommand = \say "${phrase}" -o ${filepath}`;`
appear in the conditional branches forselectedVoiceandselcetedRate.
Execution occurs via exec(execCommand, ...)`.
GET /bedroom/say/test%22;%20touch%20/tmp/pwned;%20echo%20%22x
This payload closes the quote, injects a command, and neutralizes the
Prerequisites
- Target running macOS
- macSay enabled in settings.json
- HTTP API reachable
Impact
- Full system compromise (Node.js process privileges)
CWE
CWE‑78 (OS Command Injection)
CVSS v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Score: 9.8 (Critical)
Remediation
Replace exec() with execFile() and pass arguments as an array:
const { execFile } = require('child_process');
const args = [];
if (selectedRate && selectedRate !== "default") args.push('-r',
selectedRate);
if (selectedVoice) args.push('-v', selectedVoice);
args.push(phrase, '-o', filepath);
execFile('say', args, callback);
Verification
Static code analysis of public repository (3776f0e, 2025‑03‑22). No
runtime testing required to confirm exploitability. |
|---|
| 원천 | ⚠️ https://github.com/jishi/node-sonos-http-api/issues/915 |
|---|
| 사용자 | XavLimSG (UID 95187) |
|---|
| 제출 | 2026. 02. 05. AM 09:49 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 17. PM 02:48 (12 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 346280 [jishi node-sonos-http-api 까지 3776f0ee2261c924c7b7204de121a38100a08ca7 TTS Provider mac-os.js Promise phrase 권한 상승] |
|---|
| 포인트들 | 20 |
|---|