Web Check Command Injection Vulnerability in Screenshot API Allowing Remote Code Execution

A command injection vulnerability has been identified in the screenshot API of the Web Check project (Lissy93/web-check) in versions prior to 2.0.0. The vulnerability arises from user-controlled input being passed unsanitized into a shell command via exec(), which allows attackers to execute arbitrary system commands on the host. Exploitation could involve sending crafted URL parameters to extract files or establish remote access.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Web Check is running.

Remediation

Users can update to version 2.0.1 or apply the specific commit that addresses this vulnerability by replacing exec() with execFile(), which prevents shell interpolation and execution.