CVE-2024-21488

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21488

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

V

ersions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

References
Link Resource
https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c Exploit Mitigation Third Party Advisory
https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7 Patch
https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7 Patch
https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5 Patch
https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371 Exploit Third Party Advisory
https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c Exploit Mitigation Third Party Advisory
https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7 Patch
https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7 Patch
https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5 Patch
https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:forkhq:network:*:*:*:*:*:node.js:*:*
History

21 Nov 2024, 08:54

Type Values Removed Values Added
References () https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c - Exploit, Mitigation, Third Party Advisory () https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c - Exploit, Mitigation, Third Party Advisory
References () https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7 - Patch () https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7 - Patch
References () https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7 - Patch () https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7 - Patch
References () https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5 - Patch () https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5 - Patch
References () https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371 - Exploit, Third Party Advisory () https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371 - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 7.3
Information

Published : 2024-01-30 05:15

Updated : 2024-11-21 08:54

NVD link : CVE-2024-21488

Mitre link : CVE-2024-21488

CVE.ORG link : CVE-2024-21488

JSON object : View

Products Affected

forkhq

CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')