CVE-2017-16042: Command Injection in growl
Summary
CVE-2017-16042: Growl before 1.10.0 vulnerable to Command Injection. Affects growl versions < 1.10.0. Fixed in 1.10.0. How to fix ↓
Also tracked for
- node-growl · Debian:11
The same CVE-2017-16042 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Growl is an npm package that provides a notification system for Node.js applications. It allows developers to display notifications on various platforms, including macOS, Windows, and Linux. Growl versions prior to 1.10.0 are vulnerable to command injection, which occurs when user input is not properly sanitized before being passed into a shell command. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where Growl is installed.
Vulnerability Detail
The vulnerability in Growl arises from the lack of input sanitization. When user input is used in a shell command without proper validation, an attacker can inject malicious commands. This can lead to various security risks, including remote code execution, unauthorized access to sensitive data, and complete compromise of the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
1.10.0
This is the first release that contains the fix.
npm install growl@1.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Growl to mitigate the risk of command injection.
Conclusion
Growl versions prior to 1.10.0 are vulnerable to command injection, which can lead to severe security risks. It is crucial to update to the fixed version of Growl to mitigate the risk of command injection. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for growl →
FAQ
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a system by injecting malicious input into a command execution function.
An attacker can exploit this vulnerability by providing malicious input that contains specially crafted commands. When this input is not properly sanitized, the commands are executed by the system, leading to potential compromise.
The consequences of this vulnerability can be severe. An attacker can gain unauthorized access to sensitive data, execute arbitrary code, or take complete control of the affected system.
Yes, updating Growl to version 1.10.0 or later fixes this vulnerability. It is recommended to update the package to ensure the security of your application.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights for vulnerability remediation.
