php-shellcommand Command Injection Vulnerability in mikehaertl/php-shellcommand
Summary
CVE-2019-10774: php-shellcommand command injection vulnerability. Affects mikehaertl/php-shellcommand versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- php-shellcommand · Debian:11
The same CVE-2019-10774 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mikehaertl/php-shellcommand is a package available on Packagist that provides a simple way to execute shell commands from PHP. It allows developers to run shell commands and retrieve their output or exit code. This package is commonly used in PHP applications that require interaction with the command line. However, versions before 1.6.1 of php-shellcommand are vulnerable to a command injection attack.
Vulnerability Detail
The php-shellcommand package versions before 1.6.1 are affected by a command injection vulnerability. This vulnerability allows an attacker to execute arbitrary commands on the server where the vulnerable package is installed. By exploiting this vulnerability, an attacker can potentially gain unauthorized access to the server, execute malicious code, and perform various malicious activities. The vulnerability arises due to improper input validation and sanitization of user-supplied data when constructing shell commands.
How To Fix
Minimum fixed version
1.6.1
This is the first release that contains the fix.
composer require mikehaertl/php-shellcommand:1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement strict input validation and sanitization of user-supplied data before using it in shell commands. This includes validating the input against an expected format, rejecting any unexpected characters or patterns, and using proper escaping or quoting mechanisms when constructing shell commands. However, applying these workarounds may be error-prone and may not provide complete protection against command injection attacks. Therefore, it is strongly recommended to upgrade to the fixed version of the package as soon as possible.
Conclusion
The php-shellcommand package versions before 1.6.1 are vulnerable to a command injection attack. To mitigate this vulnerability, it is crucial to upgrade to version 1.6.1 or later of the package. Additionally, developers should implement proper input validation and sanitization techniques to prevent command injection attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mikehaertl/php-shellcommand →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the server, potentially leading to unauthorized access, data theft, or further compromise of the system.
No, only versions before 1.6.1 of php-shellcommand are affected. The vulnerability has been fixed in version 1.6.1 and later.
At the time of this report, there are no known public exploits for this vulnerability. However, it is essential to apply the recommended fix promptly to mitigate the risk.
Yes, this vulnerability can be exploited remotely if the affected package is used in a web application accessible over the internet. Attackers can send specially crafted requests to exploit the command injection vulnerability.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
