CVE-2022-21191: 
JavaScript vulnerability analysis and mitigation

CVE-2022-21191 affects versions of the package global-modules-path before 3.0.0. The vulnerability is classified as a Command Injection vulnerability due to missing input sanitization in the getPath function. The issue was disclosed on December 13, 2022, and published on January 12, 2023. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) from NVD and 7.4 (HIGH) from Snyk (Snyk Advisory).

The vulnerability exists in the getPath function where missing input sanitization and lack of proper sandboxing allows for command injection. The issue stems from the usage of execSync command, which allowed threat actors to pass undesired commands through the parameters of the getPath method. The vulnerability was fixed by replacing the usage of execSync with spawnSync, which provides better protection against command injection attacks (GitHub Release).

A successful exploitation of this vulnerability could result in unauthorized access with high impact on confidentiality, integrity, and availability. According to the CVSS scoring, the vulnerability could lead to total loss of confidentiality, resulting in all resources being exposed to the attacker, complete loss of integrity allowing modification of protected files, and total loss of availability causing denial of access to resources (Snyk Advisory).

The vulnerability has a proof-of-concept exploit available. An example of exploitation involves calling the getPath function with malicious command injection parameters: root.getPath("& touch JHU","& touch exploit"). The attack requires no user interaction and can be executed by an unauthorized attacker, though it requires local access to the system (Snyk Advisory).

The recommended mitigation is to upgrade global-modules-path to version 3.0.0 or higher. The fixed version replaces the vulnerable execSync implementation with spawnSync to prevent command injection attacks. While there are no breaking changes in the API, the package maintainers note that there might be differences in the results of calling the getPath method due to the implementation change (GitHub Release).