CVE-2020-6836: Command Injection in hot-formula-parser
Summary
CVE-2020-6836: Command Injection in hot-formula-parser. Affects hot-formula-parser versions < 3.0.1. Fixed in 3.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hot-formula-parser package is an npm package used for parsing formulas. It is commonly used in applications that require formula evaluation and calculation. This package allows users to input formulas and performs the necessary calculations. However, versions prior to 3.0.1 are vulnerable to Command Injection.
Vulnerability Detail
The vulnerability in hot-formula-parser arises from the package's failure to properly sanitize values passed to the parse function. These values are concatenated in an eval call, which can lead to command injection. If a user-controlled input is used as a value in the formula, an attacker can exploit this vulnerability to execute arbitrary commands on the server. For example, a formula like "SUM([(function(){require('child_process').execSync('touch test')})(),2])" can be used to create a test file in the present directory.
How To Fix
Minimum fixed version
3.0.1
This is the first release that contains the fix.
npm install hot-formula-parser@3.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The hot-formula-parser package prior to version 3.0.1 is vulnerable to command injection, allowing attackers to execute arbitrary commands on the server. To mitigate this vulnerability, it is crucial to upgrade to version 3.0.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hot-formula-parser →
FAQ
This vulnerability allows attackers to execute arbitrary commands on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
No, only versions prior to 3.0.1 are affected. It is recommended to upgrade to version 3.0.1 or later to mitigate the vulnerability.
While there are no known public exploits for this vulnerability, it is still important to upgrade to the fixed version to prevent potential attacks.
Yes, this vulnerability can be exploited remotely if the affected application is accessible over the network.
