CVE-2020-7604: OS Command Injection in pulverizr
Summary
CVE-2020-7604: OS Command Injection in pulverizr. Affects pulverizr versions < 0.7.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pulverizr is an npm package used for a specific functionality. It allows users to perform certain actions by executing commands. However, the package is vulnerable to an OS command injection vulnerability, which can be exploited by an attacker to execute arbitrary commands on the system. This vulnerability exists in versions 0.0.0 to 0.7.0 of the package.
Vulnerability Detail
The OS command injection vulnerability in pulverizr arises from the lack of input sanitization in the 'filename' variable within the 'lib/job.js' file. An attacker can control the 'filename' variable and use it to construct an argument for the 'exec' call without proper validation. By creating a file with the same name as the attack command, an attacker can execute arbitrary commands on the system. This vulnerability has a CVSS score of 9.8 (Critical) and falls under CWE-78.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid the vulnerability by refraining from using the pulverizr package until it has been updated to a secure version.
Conclusion
The OS command injection vulnerability in pulverizr can be exploited by an attacker to execute arbitrary commands on the system. It is crucial to update the package to a secure version beyond 0.7.0 or refrain from using it until the update is available. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pulverizr →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access, data loss, or further compromise of the affected system.
There are no known public exploits available for this vulnerability at the moment. However, it is crucial to apply the recommended fix or workaround to mitigate the risk.
No, only versions 0.0.0 to 0.7.0 of the pulverizr package are affected by this OS command injection vulnerability. It is advised to update to a secure version beyond 0.7.0.
No, this vulnerability requires an attacker to have the ability to create a file with the same name as the attack command on the system. It cannot be exploited remotely without prior access to the target system.
Yes, a fix is available for this vulnerability. Users should update the pulverizr package to a version beyond 0.7.0 to ensure the vulnerability is addressed.
