Overview
In this blog post, we delve into the details of a critical vulnerability that has been identified in CodeceptJS version 3.7.3, more specifically in the emptyFolder function (lib/utils.js). This vulnerability, known as CVE-2025-57285, can potentially compromise systems or lead to data leakage. It is of paramount importance to developers, system administrators, and cybersecurity professionals who use or manage systems that run on CodeceptJS 3.7.3. A low barrier to exploitation and a high impact make this vulnerability a significant threat that requires immediate attention.
Vulnerability Summary
CVE ID: CVE-2025-57285
Severity: Critical (9.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System Compromise and Data Leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
CodeceptJS | 3.7.3
How the Exploit Works
The vulnerability is a result of the execSync command in the emptyFolder function directly concatenating the user-controlled directoryPath parameter without any form of sanitization or escaping. This permits an attacker to inject arbitrary commands that the system then executes. By exploiting this vulnerability, an attacker can manipulate the application and the system it resides on, giving the attacker the potential ability to compromise the system or leak sensitive data.
Conceptual Example Code
Below is a conceptual example of how this vulnerability might be exploited. To illustrate, an attacker could provide a shell command as the directoryPath parameter:
const CodeceptJS = require('CodeceptJS');
const directoryPath = 'any_directory; rm -rf /'; // The injected command that deletes all files in the root directory
CodeceptJS.emptyFolder(directoryPath);In this example, the command injection vulnerability is exploited to delete all files in the root directory of the server where the CodeceptJS application is running. This is a conceptual demonstration and the actual exploitation may vary based on the specific application context and system configuration.
Remember, it is crucial to apply the vendor patch as soon as possible to mitigate this vulnerability. If a patch is not immediately available, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as temporary mitigation.
