Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
References
| Link | Resource |
|---|---|
| https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9 | Exploit Third Party Advisory |
| https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3 | Patch |
| https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318 | Exploit Third Party Advisory |
| https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9 | Exploit Third Party Advisory |
| https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3 | Patch |
| https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9 - Exploit, Third Party Advisory | |
| References | () https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3 - Patch | |
| References | () https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
21 Sep 2023, 19:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318 - Exploit, Third Party Advisory | |
| References | (MISC) https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9 - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3 - Patch | |
| First Time |
Blamer Project
Blamer Project blamer |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| CWE | CWE-88 | |
| CPE | cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:* |
19 Sep 2023, 05:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-19 05:17
Updated : 2024-11-21 07:50
NVD link : CVE-2023-26143
Mitre link : CVE-2023-26143
CVE.ORG link : CVE-2023-26143
JSON object : View
Products Affected
blamer_project
- blamer
CWE
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')