CVE-2020-7697: Code injection in mock2easy
Summary
CVE-2020-7697: Code injection in mock2easy. Affects mock2easy versions < 0.0.24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mock2easy is an npm package used for mocking and generating mock data for APIs. It provides a server that can be used to intercept API requests and return mock responses. The package is vulnerable to code injection due to improper handling of user-supplied input. This vulnerability allows a malicious user to inject arbitrary commands through the _data variable, leading to remote code execution.
Vulnerability Detail
The vulnerability exists in the require('../server/getJsonByCurl') function of mock2easy. The function takes several parameters, including _data, which is used to construct a command for executing a curl request. However, the _data variable is not properly sanitized or validated, allowing an attacker to inject arbitrary commands. This can result in unauthorized access, data leakage, or even complete compromise of the system. The vulnerability affects all versions up to and including version 0.0.24 of the mock2easy package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize and validate the _data variable before passing it to the require('../server/getJsonByCurl') function. This can be done by implementing input validation and sanitization techniques, such as using regular expressions to restrict the allowed characters and removing any potentially dangerous commands or characters.
Conclusion
The code injection vulnerability in mock2easy allows an attacker to execute arbitrary commands through the _data variable. To mitigate this vulnerability, it is crucial to update to a version of mock2easy that is not affected by the issue. Alternatively, implement input validation and sanitization techniques to mitigate the risk until an upgrade is possible. For further support and guidance on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mock2easy →
FAQ
mock2easy is an npm package used for mocking and generating mock data for APIs. It provides a server that can intercept API requests and return mock responses.
Code injection is a vulnerability that allows an attacker to insert and execute arbitrary code in a target system. In the case of mock2easy, the vulnerability allows an attacker to inject commands through the _data variable, leading to remote code execution.
The consequences of this vulnerability can vary depending on the context in which mock2easy is used. However, possible ramifications include unauthorized access, data leakage, and complete compromise of the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing the vulnerability in your application.
