CVE-2020-7738: Arbitrary Code Execution in shiba
Summary
CVE-2020-7738: Arbitrary Code Execution in shiba. Affects shiba versions < 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shiba is an npm package that provides functionality for working with YAML files in JavaScript. It includes a function called load() which is used to parse YAML data. However, all versions of the package are vulnerable to Arbitrary Code Execution due to the default usage of the insecure function load() instead of its secure replacement, safeLoad(). This vulnerability can allow an attacker to execute arbitrary code on a system where the vulnerable package is used.
Vulnerability Detail
The vulnerability in shiba arises from the insecure usage of the load() function from the js-yaml package. By exploiting this vulnerability, an attacker can inject malicious YAML data that contains executable code. When the vulnerable package parses this data using the load() function, the injected code gets executed, leading to arbitrary code execution. This can have severe consequences, such as unauthorized access, data breaches, and system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually replace the usage of the load() function with safeLoad() in their code. Here is an example of how to do this:
const yaml = require('js-yaml');
const fs = require('fs');
const data = fs.readFileSync('data.yaml', 'utf8');
const parsedData = yaml.safeLoad(data);
Conclusion
The vulnerability in shiba allows for arbitrary code execution due to the insecure usage of the load() function. It is crucial to update the package to a version that uses the secure replacement function, safeLoad(), and follow secure coding practices to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for shiba →
FAQ
This vulnerability can allow an attacker to execute arbitrary code on a system where the vulnerable shiba package is used. This can lead to unauthorized access, data breaches, and system compromise.
All versions of shiba up to and including version 1.2.1 are affected by this vulnerability.
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the package-lock.json file.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-jvf4-g24p-2qgw/GHSA-jvf4-g24p-2qgw.json
References
Related vulnerabilities
Recent vulnerabilities recorded for shiba.
