CVE-2020-28440: Command Injection in corenlp-js-interface
Summary
CVE-2020-28440: Command Injection in corenlp-js-interface. Affects corenlp-js-interface versions < 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
corenlp-js-interface is an npm package that provides an interface for interacting with the CoreNLP server. It allows users to perform natural language processing tasks using the Stanford CoreNLP library. The package is widely used for various text analysis and language processing applications. However, all versions of corenlp-js-interface are vulnerable to Command Injection through the main function.
Vulnerability Detail
The vulnerability in corenlp-js-interface arises from a lack of input validation in the main function. Attackers can exploit this by injecting malicious commands into user-supplied input, which are then executed by the application. This can lead to arbitrary command execution with the privileges of the application, potentially resulting in unauthorized access, data loss, or remote code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to sanitize and validate user input before passing it to the main function. This can be done by implementing strict input validation and filtering out any potentially malicious characters or commands. Here's an example of how to sanitize user input in JavaScript:
const sanitizedInput = userInput.replace(/[&|;`$()\<>]/g, '');
Conclusion
In conclusion, corenlp-js-interface is vulnerable to Command Injection, which can lead to arbitrary command execution with the privileges of the application. Users should update to the latest version of the package (1.0.4 or later) to fix this vulnerability. If immediate update is not possible, implementing strict input validation can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for corenlp-js-interface →
FAQ
corenlp-js-interface is an npm package that provides an interface for interacting with the CoreNLP server. It allows users to perform natural language processing tasks using the Stanford CoreNLP library.
Command Injection is a security vulnerability that allows an attacker to execute arbitrary commands on a target system. In the case of corenlp-js-interface, the vulnerability allows an attacker to inject malicious commands through user-supplied input, which are then executed by the application.
The consequences of this vulnerability can be severe. An attacker can execute arbitrary commands with the privileges of the application, potentially leading to unauthorized access, data loss, or remote code execution.
Yes, a fix is available for this vulnerability. Users of corenlp-js-interface should update to version 1.0.4 or later to mitigate the risk of command injection attacks.
To sanitize user input and prevent command injection, it is important to implement strict input validation. This involves filtering out any potentially malicious characters or commands from user-supplied input before using it in the application.
