{"id":74632,"date":"2025-09-13T14:02:54","date_gmt":"2025-09-13T14:02:54","guid":{"rendered":""},"modified":"2025-09-29T02:50:16","modified_gmt":"2025-09-29T08:50:16","slug":"cve-2025-57285-critical-command-injection-vulnerability-in-codeceptjs-3-7-3","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-57285-critical-command-injection-vulnerability-in-codeceptjs-3-7-3\/","title":{"rendered":"CVE-2025-57285: Critical Command Injection Vulnerability in CodeceptJS 3.7.3<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

In this blog post, we delve into the details of a critical vulnerability that has been identified in CodeceptJS version 3.7.3, more specifically in the emptyFolder function (lib\/utils.js). This vulnerability, known as CVE-2025-57285, can potentially compromise systems or lead to data leakage. It is of paramount importance to developers, system administrators, and cybersecurity professionals who use or manage systems<\/a> that run on CodeceptJS 3.7.3. A low barrier to exploitation and a high impact make this vulnerability<\/a> a significant threat that requires immediate attention.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-57285
\nSeverity: Critical (9.8 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System Compromise<\/a> and Data Leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

CodeceptJS | 3.7.3<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability is a result of the execSync command<\/a> in the emptyFolder function directly concatenating the user-controlled directoryPath parameter without any form of sanitization or escaping. This permits an attacker to inject arbitrary commands that the system then executes<\/a>. By exploiting this vulnerability, an attacker can manipulate the application and the system it resides on, giving the attacker the potential ability to compromise the system<\/a> or leak sensitive data.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how this vulnerability might be exploited. To illustrate, an attacker could provide a shell command as the directoryPath parameter:<\/p>\n

const CodeceptJS = require('CodeceptJS');\nconst directoryPath = 'any_directory; rm -rf \/'; \/\/ The injected command that deletes all files in the root directory\nCodeceptJS.emptyFolder(directoryPath);<\/code><\/pre>\n
In this example, the command injection vulnerability is exploited to delete all files<\/a> in the root directory of the server where the CodeceptJS application is running. This is a conceptual demonstration and the actual exploitation may vary based on the specific application context and system configuration<\/a>.
\nRemember, it is crucial to apply the vendor patch as soon as possible to mitigate this vulnerability<\/a>. If a patch is not immediately available, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as temporary mitigation.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview In this blog post, we delve into the details of a critical vulnerability that has been identified in CodeceptJS version 3.7.3, more specifically in the emptyFolder function (lib\/utils.js). This vulnerability, known as CVE-2025-57285, can potentially compromise systems or lead to data leakage. It is of paramount importance to developers, system administrators, and cybersecurity professionals […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[78],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-74632","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-injection"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t