CVE-2020-7646: Command Execution in curlrequest
Summary
CVE-2020-7646: curlrequest allows execution of arbitrary commands. Affects curlrequest versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curlrequest package is an npm package that provides a convenient way to make HTTP requests using the curl command-line tool. It allows developers to send HTTP requests and retrieve responses programmatically. However, versions up to 1.0.1 of curlrequest are vulnerable to command execution attacks.
Vulnerability Detail
The vulnerability (CVE-2020-7646) in curlrequest allows an attacker to execute arbitrary commands. By using a semicolon character in any of the options values, an attacker can inject additional commands that will be executed by the underlying system. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can sanitize the options values to remove any semicolon characters before passing them to the curlrequest package. This can be done by using a regular expression or a string replace function to remove or escape semicolons. Here's an example in JavaScript:
const sanitizedOptions = options.replace(/;/g, '');
Conclusion
The vulnerability (CVE-2020-7646) in curlrequest allows for command execution, which can have severe consequences for the affected system. It is crucial to upgrade to a patched version of curlrequest (1.0.2 or higher) to mitigate this vulnerability. Additionally, developers can apply the provided workaround to sanitize the options values. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curlrequest →
FAQ
curlrequest is an npm package that allows developers to make HTTP requests using the curl command-line tool.
This vulnerability allows an attacker to execute arbitrary commands, potentially leading to unauthorized access, data leakage, or complete compromise of the affected system.
Versions up to and including 1.0.1 of curlrequest are affected by this vulnerability.
To fix this vulnerability, you should upgrade to a patched version of curlrequest (1.0.2 or higher) by updating your package.json file and running npm install.
Yes, as a temporary workaround, you can sanitize the options values to remove any semicolon characters before passing them to curlrequest. See the 'workaround' section for an example.
