CVE-2019-10789: OS Command Injection in curling
Summary
CVE-2019-10789: OS Command Injection in curling. Affects curling versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curling npm package is a utility that allows users to make HTTP requests from the command line. It provides a simple interface for sending HTTP requests and receiving responses. However, versions before 1.1.0 are vulnerable to OS Command Injection. This vulnerability arises from the lack of sanitization of the command argument in the run function, allowing users to execute arbitrary commands on the host system.
Vulnerability Detail
The OS Command Injection vulnerability in curling allows an attacker to execute arbitrary commands on the host system by manipulating the command argument. This can lead to various security risks, including unauthorized access, data leakage, and remote code execution. The vulnerability has a CVSS score of 9.8, indicating its high severity.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
npm install curling@1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the command argument before passing it to the run function. This can be done by validating and restricting the input to known safe values. Here's an example of how to sanitize the command argument using regular expressions in JavaScript:
const sanitizedCommand = command.replace(/[&|;`$()\]/g, '');
Conclusion
The OS Command Injection vulnerability in the curling npm package can have severe consequences, including unauthorized access and remote code execution. It is crucial to upgrade to version 1.1.0 or later to mitigate this vulnerability. In the meantime, you can apply the provided workaround to sanitize the command argument. For additional support and guidance, please contact DevNack.com.
See every vulnerability recorded for curling →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data leakage, and remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for any known vulnerabilities.
Yes, upgrading to version 1.1.0 or later of the curling package fixes this vulnerability. Make sure to update your package by running npm install curling@latest.
As a temporary workaround, you can manually sanitize the command argument before passing it to the run function. Refer to the 'workaround' section for an example of how to do this.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com.
