CVE-2013-7377

Name of the Vulnerable Software and Affected Versions: codem-transcode module versions prior to 0.5.0

Description: The issue allows remote attackers to execute arbitrary commands via a POST request to "/probe" when ffprobe is enabled. This is possible because HTTP POST requests to "/probe" are passed to the ffprobe binary on the server, allowing a malformed source file name to be sent, resulting in arbitrary command execution. The ffprobe functionality is not enabled by default, and exploitation opportunities are limited in a standard configuration because the server binds to the local interface by default.

Recommendations: For versions prior to 0.5.0, update to version 0.5.0 or later, available via npm, especially if the ffprobe functionality is enabled. As a temporary workaround, consider disabling the ffprobe functionality until the update is applied. Restrict access to the "/probe" endpoint to minimize the risk of exploitation.