CVE-2015-7982: Command Injection in gm
Summary
CVE-2015-7982: Command Injection in gm. Affects gm versions < 1.21.1. Fixed in 1.21.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gm package is an npm package used for image manipulation. It provides a set of tools and functions for working with graphics and images. The package is widely used in various applications and frameworks to perform tasks such as resizing, cropping, and applying filters to images. However, versions of gm prior to 1.21.1 are vulnerable to a command injection vulnerability.
Vulnerability Detail
The command injection vulnerability in gm is triggered when user input is passed into the gm.compare() function without proper sanitization. This allows an attacker to inject arbitrary commands into the system, potentially leading to remote code execution or other malicious activities. The vulnerability arises from a failure to correctly sanitize user input before calling the graphics magic binary. An attacker can exploit this vulnerability by crafting malicious input that includes shell commands, which are then executed by the system.
How To Fix
Minimum fixed version
1.21.1
This is the first release that contains the fix.
npm install gm@1.21.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to validate and sanitize user input before passing it to the gm.compare() function. This can be done by implementing input validation and filtering mechanisms to ensure that only expected and safe input is processed by the function. Additionally, it is recommended to restrict access to the affected functionality or disable it altogether until the package can be updated.
Conclusion
The command injection vulnerability in gm can have severe consequences, including remote code execution. It is crucial to update to version 1.21.1 or later of the gm package to mitigate this vulnerability. If immediate update is not possible, implementing input validation and sanitization mechanisms can provide temporary protection. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gm →
FAQ
The command injection vulnerability in gm can lead to remote code execution, allowing an attacker to execute arbitrary commands on the system. This can result in unauthorized access, data breaches, and other malicious activities.
Versions of gm prior to 1.21.1 are affected by this vulnerability.
While there may not be a publicly known exploit for this specific vulnerability, command injection vulnerabilities are commonly targeted by attackers. It is important to address this vulnerability promptly to prevent potential exploitation.
The recommended mitigation is to update to version 1.21.1 or later of the gm package. If immediate update is not possible, implementing input validation and sanitization mechanisms can help mitigate the risk until the package can be updated.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-pjh3-jv7w-9jpr/GHSA-pjh3-jv7w-9jpr.json
