Command Injection Vulnerability in Clamscan
Summary
CVE-2020-7613: Clamscan vulnerable to command injection. Affects clamscan versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Clamscan is an npm package used for scanning files and directories for malware using the ClamAV antivirus engine. It provides a convenient interface for integrating antivirus scanning into Node.js applications. However, versions up to 1.2.0 of Clamscan are vulnerable to command injection.
Vulnerability Detail
The vulnerability in Clamscan allows an attacker to execute arbitrary commands by injecting them into the _is_clamav_binary function in the Index.js file. To exploit this vulnerability, the attacker needs to create a folder with a command that will be executed. This vulnerability poses a high risk as it can lead to unauthorized command execution and potential compromise of the system.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
npm install clamscan@1.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately possible, a temporary workaround is to avoid using the affected functions that are susceptible to command injection. Review the codebase and ensure that user input is properly validated and sanitized before being passed to the vulnerable functions.
Conclusion
The command injection vulnerability in Clamscan can be mitigated by updating to the latest version or applying the provided workaround. It is crucial to promptly address this vulnerability to prevent unauthorized command execution and potential compromise of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for clamscan →
FAQ
Clamscan is an npm package that provides a convenient interface for integrating antivirus scanning into Node.js applications. It uses the ClamAV antivirus engine to scan files and directories for malware.
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a system. In the case of Clamscan, the vulnerability allows an attacker to inject malicious commands into the _is_clamav_binary function, leading to unauthorized command execution.
The command injection vulnerability in Clamscan can lead to unauthorized command execution, potentially allowing an attacker to take control of the system or access sensitive information.
Yes, the vulnerability can be fixed by updating Clamscan to version 1.3.0 or higher. This version includes a patch for the command injection vulnerability.
If updating to the latest version is not immediately possible, a temporary workaround is to avoid using the affected functions that are susceptible to command injection. Additionally, ensure that user input is properly validated and sanitized before being passed to the vulnerable functions.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
