Codeceptjs Command Injection Vulnerability in EmptyFolder Function

A command injection vulnerability has been identified in Codeceptjs version 3.7.3. The issue arises in the emptyFolder function within lib/utils.js, where the execSync command improperly concatenates the user-controlled directoryPath parameter without adequate sanitization or escaping. This flaw enables attackers to execute arbitrary commands.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where Codeceptjs is running.

Reproduction

To reproduce this vulnerability, create a malicious configuration object that includes a crafted output path. The path should be designed to exploit the command injection vulnerability by appending a command after a semicolon. Then, initialize a Codecept instance with this configuration and call the emptyFolder function. The injected command will be executed, demonstrating the command injection vulnerability.