CVE-2020-7621: OS Command Injection in strong-nginx-controller
Summary
CVE-2020-7621: OS Command Injection in strong-nginx-controller. Affects strong-nginx-controller versions < 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
strong-nginx-controller is an npm package that provides functionality for managing NGINX configurations. It allows users to control NGINX instances and perform various operations. However, versions up to 1.0.2 are vulnerable to OS Command Injection, which can lead to the execution of arbitrary commands within the '_nginxCmd()' function.
Vulnerability Detail
The OS Command Injection vulnerability in strong-nginx-controller allows an attacker to inject and execute arbitrary commands. This can be exploited by manipulating user-controlled input that is not properly validated or sanitized. The vulnerability has a CVSS score of 9.8 (Critical) and can result in unauthorized command execution, leading to potential data breaches, system compromise, or further exploitation of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to avoid using user-controlled input in commands or ensure proper input validation and sanitization. Additionally, it is recommended to restrict access to the vulnerable component or disable it if not required.
Conclusion
strong-nginx-controller up to version 1.0.2 is vulnerable to OS Command Injection, which can lead to unauthorized command execution. It is crucial to update to a non-affected version and follow best practices for input validation and sanitization. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for strong-nginx-controller →
FAQ
strong-nginx-controller is an npm package used for managing NGINX configurations.
OS Command Injection is a vulnerability that allows an attacker to execute arbitrary commands on a target system.
This vulnerability can lead to unauthorized command execution, potentially resulting in data breaches, system compromise, or further exploitation.
To fix this vulnerability, update strong-nginx-controller to a non-affected version using the command 'npm update strong-nginx-controller'.
As a temporary workaround, avoid using user-controlled input in commands and ensure proper input validation and sanitization.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
