CVE-2021-23352: Improper Neutralization of Special Elements used in a Command in madge
Summary
CVE-2021-23352: Madge vulnerable to command injection. Affects madge versions < 4.0.1. Fixed in 4.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Madge is an npm package used for analyzing and visualizing dependencies in JavaScript projects. It provides various functions to generate graphs and diagrams. However, versions before 4.0.1 are vulnerable to an improper neutralization of special elements used in a command. This vulnerability allows an attacker to execute arbitrary commands by specifying a custom Graphviz path via the graphVizPath option parameter. When the .image(), .svg(), or .dot() functions are called, the vulnerable code executes the specified command using the childprocess.exec function.
Vulnerability Detail
The vulnerability in madge allows an attacker to execute arbitrary commands on the host system. By manipulating the graphVizPath option parameter, an attacker can provide a malicious command that will be executed when the vulnerable functions are called. This can lead to unauthorized access, data leakage, or even complete compromise of the host system. The vulnerability is rated as HIGH severity and is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-89 (Improper Neutralization of Special Elements used in an OS Command).
How To Fix
Minimum fixed version
4.0.1
This is the first release that contains the fix.
npm install madge@4.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a workaround can be implemented by avoiding the use of the vulnerable functions (.image(), .svg(), and .dot()). Instead, consider using alternative methods or libraries to generate graphs and diagrams.
Conclusion
The vulnerability in madge before version 4.0.1 allows for arbitrary command execution, posing a significant security risk. It is recommended to upgrade to the fixed version or implement the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for madge →
FAQ
Madge is an npm package used for analyzing and visualizing dependencies in JavaScript projects. It provides functions to generate graphs and diagrams.
The vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data leakage, or complete compromise of the system.
Upgrade to version 4.0.1 or later of the madge package. Run the command 'npm install madge@4.0.1' to update the package.
If immediate upgrade is not possible, avoid using the vulnerable functions (.image(), .svg(), and .dot()) and consider alternative methods or libraries for generating graphs and diagrams.
Yes, the vulnerability can potentially lead to data loss if an attacker executes malicious commands on the host system.
