CVE-2017-16100: Command Injection in dns-sync
Summary
CVE-2017-16100: Command Injection in dns-sync. Affects dns-sync versions < 0.1.1. Fixed in 0.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dns-sync package is an npm package used for DNS resolution in Node.js applications. It provides a resolve() method for resolving domain names to IP addresses synchronously. This package is vulnerable to an arbitrary command execution vulnerability in the resolve() method.
Vulnerability Detail
The vulnerability in dns-sync allows an attacker to execute arbitrary commands by injecting malicious input into the resolve() method. This can lead to remote code execution and potential compromise of the affected system. The vulnerability was identified in versions 0.0.1 to 0.1.0 of the package.
How To Fix
Minimum fixed version
0.1.1
This is the first release that contains the fix.
npm install dns-sync@0.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The dns-sync package has a critical command injection vulnerability in the resolve() method, allowing for arbitrary command execution. It is recommended to use an alternative DNS resolver and ensure that untrusted input is not allowed into the affected method. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for dns-sync →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the affected system, potentially leading to remote code execution and compromise of the system.
Versions 0.0.1 to 0.1.0 of dns-sync are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment.
Yes, the vulnerability can be fixed by using an alternative DNS resolver and ensuring that untrusted input is not allowed into the dns-sync.resolve() method.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-jcw8-r9xm-32c6/GHSA-jcw8-r9xm-32c6.json
References
Related vulnerabilities
Recent vulnerabilities recorded for dns-sync.
