Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.
References
| Link | Resource |
|---|---|
| https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c | Exploit Mitigation Third Party Advisory |
| https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7 | Patch |
| https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7 | Patch |
| https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5 | Patch |
| https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371 | Exploit Third Party Advisory |
Configurations
History
08 Feb 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on. |
06 Feb 2024, 18:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5 - Patch | |
| References | () https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7 - Patch | |
| References | () https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c - Exploit, Mitigation, Third Party Advisory | |
| References | () https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7 - Patch | |
| References | () https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:forkhq:network:*:*:*:*:*:node.js:*:* | |
| CWE | CWE-77 | |
| First Time |
Forkhq
Forkhq network |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
30 Jan 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-30 05:15
Updated : 2024-02-28 20:54
NVD link : CVE-2024-21488
Mitre link : CVE-2024-21488
CVE.ORG link : CVE-2024-21488
JSON object : View
Products Affected
forkhq
- network
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')