CVE-2021-23399: Arbitrary Command Injection in wincred
Summary
CVE-2021-23399: Arbitrary Command Injection. Affects wincred versions < 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wincred package is an npm package that provides functionality for managing Windows credentials. It allows users to store and retrieve credentials securely. The package is widely used in Windows-based applications and is an essential component for managing user authentication and authorization. However, all versions of the wincred package are vulnerable to arbitrary command injection.
Vulnerability Detail
The vulnerability (CVE-2021-23399) in the wincred package arises from the getCredential function's failure to properly sanitize user input. If an attacker-controlled user input is passed to this function, it can lead to the execution of arbitrary commands. The vulnerability stems from the use of the child_process exec function without input sanitization. This allows an attacker to inject malicious commands, potentially leading to unauthorized access, data breaches, or system compromise. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement input sanitization and validation manually before passing user input to the getCredential function. This can involve filtering out any potentially malicious characters or using input validation libraries. However, it is strongly advised to update to the latest version of the wincred package as soon as possible.
Conclusion
The wincred package is vulnerable to arbitrary command injection, which can have severe consequences such as unauthorized access and data breaches. It is crucial to update to the latest version of the package (1.0.3 or above) and implement proper input sanitization and validation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for wincred →
FAQ
The wincred package is an npm package used for managing Windows credentials securely.
The vulnerability (CVE-2021-23399) is an arbitrary command injection issue that allows attackers to execute arbitrary commands by providing malicious user input to the getCredential function.
The vulnerability can lead to unauthorized access, data breaches, or compromise of the affected system.
To fix this vulnerability, update the wincred package to version 1.0.3 or above and ensure proper input sanitization and validation.
As a temporary workaround, implement input sanitization and validation manually before passing user input to the getCredential function. However, updating to the latest version is strongly recommended.
