CVE-2024-21488

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c	Exploit Mitigation Third Party Advisory
https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7	Patch
https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7	Patch
https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5	Patch
https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:forkhq:network:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2024-01-30 05:15

Updated : 2024-02-08 13:15

NVD link : CVE-2024-21488

Mitre link : CVE-2024-21488

CVE.ORG link : CVE-2024-21488

JSON object : View

Products Affected

forkhq

network

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2024-21488", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2024-01-30T05:15:09.277", "references": [{"url": "https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7", "tags": ["Patch"], "source": "report@snyk.io"}, {"url": "https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7", "tags": ["Patch"], "source": "report@snyk.io"}, {"url": "https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5", "tags": ["Patch"], "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Secondary", "source": "report@snyk.io", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on."}, {"lang": "es", "value": "Las versiones de la red de paquetes anteriores a la 0.7.0 son vulnerables a la inyecci\u00f3n de comandos arbitrarios debido al uso de la funci\u00f3n ejecutiva child_process sin sanitizaci\u00f3n de entrada. Si se proporciona entrada de usuario (controlada por el atacante) a la funci\u00f3n mac_address_for del paquete, es posible que un atacante ejecute comandos arbitrarios en el sistema operativo en el que se ejecuta este paquete."}], "lastModified": "2024-02-08T13:15:09.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:forkhq:network:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "D7E1F6C0-7EF1-4EE0-9BEE-BD4B94EA0B33", "versionEndExcluding": "0.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}