WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution (RCE) in test orchestration. Git permits branch names containing shell metacharacters, and getGitMetadataForAISelection() interpolates these names directly into execSync() calls without sanitization. An attacker can exploit this by supplying a malicious repository (via testOrchestrationOptions.runSmartSelection.source, or the current directory if unset) whose branch name carries a payload, causing the shell to execute arbitrary code. This enables remote code execution on CI/CD servers and developer machines, leading to credential and secret disclosure, source code and SSH key exfiltration, system compromise, and supply chain attacks via tampered build artifacts. The issue has been fixed in version 9.24.0.
The getGitMetadataForAISelection() function retrieves Git branch names and interpolates them directly into execSync() calls without any input sanitization (CWE-78). Since Git allows branch names containing shell metacharacters, an attacker can prepare a malicious repository with an appropriately crafted branch name containing a payload. The malicious repository can be provided via the testOrchestrationOptions.runSmartSelection.source option, or if this option is not set, the attacker can influence the current working directory. The system shell then interprets the injected metacharacters as commands and executes them with the privileges of the process running the tests.
An attacker can execute arbitrary code on the victim's machine, which leads to disclosure of credentials and secrets, exfiltration of source code and SSH keys, system compromise, and supply chain attacks through manipulation of build artifacts.
WebdriverIO should be updated to version 9.24.0 or newer, in which the issue has been fixed. Patches are available in the official manufacturer's repository on GitHub (tag v9.24.0).
WebdriverIO (package @wdio/browserstack-service) in all versions below 9.24.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpenjsf Webdriverio
APPOpenjsf< 9.24.0
Related vulnerabilities
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error....
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the use...
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes...
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an...
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the comp...