ngrok Command Injection Vulnerability

A command injection vulnerability exists in ngrok versions 4.3.3 and 5.0.0-beta.2. This vulnerability allows an attacker to execute arbitrary commands on the system where ngrok is running.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the host system.

Reproduction

To reproduce this vulnerability, use the ngrok npm package and create a script that includes a malicious option to the 'binPath' parameter. This option should be crafted to execute a command, such as creating a file in the current directory. When the 'getVersion' method is called with these options, the injected command will be executed, demonstrating the command injection vulnerability.