CVE-2025-55294

Executive Summary

CVE-2025-55294 is a critical command injection vulnerability in the screenshot-desktop npm package (versions prior to 1.15.2). The flaw exists in the screenshot() function, where user-controlled input supplied to the format option is directly interpolated into a shell command without sanitization. This allows an attacker to execute arbitrary commands with the privileges of the calling process. With a CVSS score of 9.8, this vulnerability poses a severe risk to any application that passes untrusted input to the format parameter. The vendor has released a fix in version 1.15.2.

Supply Chain & Package Security

This vulnerability affects the screenshot-desktop npm package. Applications that use this package and allow user-controlled input to influence the format option are at risk. The attack vector is remote if the application exposes this functionality via a web interface or API. The package is widely used for capturing screenshots in Node.js applications, making this a significant supply chain risk. Developers must immediately update to version 1.15.2 or later and audit any code that passes user input to the screenshot() function.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely if the application accepts user input.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Arbitrary commands can be executed.
• Availability (A): High (H) – System can be disrupted.

Threat Level: Critical. The combination of remote exploitability, low complexity, and no required privileges makes this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The screenshot-desktop package uses a shell command (likely scrot, import, or similar) to capture screenshots. The format option is used to specify the output file format (e.g., png, jpg). In vulnerable versions, this option is directly concatenated into a shell command string without escaping or sanitization.

For example, the vulnerable code might look like:

const cmd = `scrot -q 100 ${format}`;
exec(cmd, callback);

If an attacker provides a format value like png; malicious_command, the shell interprets the semicolon as a command separator, executing the attacker's payload.

The fix in version 1.15.2 likely involves using execFile instead of exec, or properly escaping the input using a library like shell-escape.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.15.2):

const { exec } = require('child_process');
function screenshot(options) {
  const format = options.format || 'png';
  const cmd = `scrot -q 100 ${format}`;
  exec(cmd, (err, stdout, stderr) => {
    // handle result
  });
}

Patched Code (1.15.2+):

const { execFile } = require('child_process');
function screenshot(options) {
  const format = options.format || 'png';
  // Use execFile to avoid shell injection
  execFile('scrot', ['-q', '100', format], (err, stdout, stderr) => {
    // handle result
  });
}

The patched version uses execFile which does not spawn a shell, thus preventing command injection. Alternatively, the input could be sanitized with a whitelist of allowed formats.

Exploitation & Lab Setup

Red Team (Offensive)

Proof of Concept (PoC):

const screenshot = require('screenshot-desktop');
// Malicious format option to execute a command
screenshot({ format: 'png; echo "pwned" > /tmp/pwned.txt' })
  .then((img) => {
    console.log('Screenshot taken');
  })
  .catch((err) => {
    console.error(err);
  });

Lab Setup:

1. Install vulnerable version: npm install screenshot-desktop@1.15.0
2. Create a simple Node.js app that accepts user input for the format option.
3. Run the app and send a request with the malicious format payload.
4. Verify command execution (e.g., check for /tmp/pwned.txt).

Exploit-DB Code: None available.

Blue Team (Defensive)

Detection:

• Monitor for unusual child process executions (e.g., scrot with unexpected arguments).
• Look for shell metacharacters (;, |, &, `) in the format parameter.
• Use the Sigma rule below to detect exploitation attempts.

Hunting:

• Search logs for scrot commands with suspicious arguments.
• Check for outbound connections or file modifications following a screenshot capture.

Indicators of Compromise (IOCs)

• File: /tmp/pwned.txt (or similar files created by attacker)
• Process: scrot -q 100 png; <malicious_command>
• Network: Unexpected outbound connections from the Node.js process
• Logs: Shell command execution logs containing scrot with special characters

Detection Engineering

YARA Rule

rule CVE_2025_55294_CommandInjection {
  meta:
    description = "Detects command injection attempts against screenshot-desktop"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-55294"
  strings:
    $s1 = "screenshot-desktop" nocase
    $s2 = "format" nocase
    $s3 = /[;&|`$()]/
  condition:
    all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-55294 - Command Injection in screenshot-desktop
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of command injection in screenshot-desktop via format option
author: Valters IT
date: 2025/04/10
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    CommandLine|contains: 'scrot'
    CommandLine|contains|all:
      - '-q'
      - '100'
    CommandLine|contains:
      - ';'
      - '|'
      - '&'
      - '`'
      - '$('
  condition: selection
falsepositives:
  - Legitimate use of special characters in format (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55294 - Command Injection in screenshot-desktop"; flow:to_server,established; content:"format"; nocase; pcre:"/format\s*=\s*[^&]*[;&|`$]/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Update: Upgrade screenshot-desktop to version 1.15.2 or later.
2. Input Validation: If updating is not possible, implement strict input validation for the format option. Only allow alphanumeric characters and a whitelist of known formats (e.g., png, jpg, bmp).
3. Use execFile: Ensure any custom code using exec is replaced with execFile or spawn to avoid shell injection.
4. Monitor Logs: Actively monitor for suspicious process executions and network connections.
5. Apply WAF Rules: Use Web Application Firewall rules to block requests containing shell metacharacters in the format parameter.

Valters IT
Securing Digital Frontiers