CVE-2019-10777: OS Command Injection in aws-lambda
Summary
CVE-2019-10777: OS command injection in aws-lambda. Affects aws-lambda versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The aws-lambda package is an npm package used for serverless computing with AWS Lambda. It provides a framework for running serverless functions in the AWS cloud. This package allows developers to deploy their code as functions without worrying about infrastructure management. However, versions prior to 1.0.5 of aws-lambda are vulnerable to OS command injection.
Vulnerability Detail
The vulnerability (CVE-2019-10777) in aws-lambda versions prior to 1.0.5 arises from the lack of sanitization of the "config.FunctionName" argument used within the "exec" function. An attacker can exploit this vulnerability by injecting arbitrary commands into the "zipCmd" parameter of the "config.FunctionName" argument. This can lead to remote code execution and unauthorized access to the underlying system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
npm install aws-lambda@1.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of aws-lambda to mitigate the risk of OS command injection.
Conclusion
The aws-lambda package prior to version 1.0.5 is vulnerable to OS command injection, which can lead to remote code execution and unauthorized access. It is crucial to upgrade to the fixed version to mitigate this risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for aws-lambda →
FAQ
aws-lambda is an npm package used for serverless computing with AWS Lambda. It allows developers to deploy code as functions without managing the underlying infrastructure.
OS command injection is a vulnerability that allows an attacker to execute arbitrary commands on the underlying operating system. In the case of aws-lambda, this vulnerability can lead to remote code execution and unauthorized access.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8, indicating its high severity and potential impact.
To fix this vulnerability, you should upgrade to aws-lambda version 1.0.5 or later. Ensure that your package dependencies are updated to use the latest secure version.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
