CVE-2021-34083: Command Injection in google-it
Summary
CVE-2021-34083: Command injection in google-it. Affects google-it versions < 1.6.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
google-it is a Node.js package available on npm that allows users to send search queries to Google and receive the results in a JSON format. It provides a convenient way to interact with the Google search engine programmatically. However, versions up to 1.6.2 of google-it are vulnerable to command injection, which can lead to remote code execution (RCE) on the server.
Vulnerability Detail
The vulnerability in google-it arises when using the 'Open in browser' option. In affected versions, the package concatenates the link obtained from Google search results to a shell command without proper sanitization. This can allow an attacker to inject malicious commands and potentially execute arbitrary code on the server. The impact of this vulnerability is high, as it can lead to unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'Open in browser' option in google-it until the package is updated to a secure version. By refraining from using this feature, the risk of command injection and potential RCE can be mitigated.
Conclusion
In conclusion, the google-it package versions up to 1.6.2 are vulnerable to command injection, which can lead to remote code execution. It is crucial to update to a secure version of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for google-it →
FAQ
google-it is a Node.js package that allows users to send search queries to Google and receive the results in a JSON format. It simplifies programmatically interacting with the Google search engine.
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a target system. In the case of google-it, the vulnerability arises from unsafely concatenating user-controlled input to a shell command.
The impact of this vulnerability can be severe. An attacker can potentially execute arbitrary code on the server, leading to unauthorized access, data leakage, or complete compromise of the affected system.
To fix this vulnerability, update google-it to a version that includes the necessary security patches. The maintainers have addressed this issue in versions beyond 1.6.2.
As a temporary workaround, avoid using the 'Open in browser' option in google-it until the package is updated. This will help mitigate the risk of command injection and potential remote code execution.
