Command Injection Vulnerability in Lodash Package: CVE-2021-23337
Summary
CVE-2021-23337: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Affects node-lodash across 2 version ranges.
< 4.17.21+dfsg+~cs8.31.173-1
< c6e281b878b315c7a10d90f9c2af4cdb112d9625
Fixed in 4.17.21+dfsg+~cs8.31.173-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lodash is a popular JavaScript utility library that provides modularity, performance, and extras for JavaScript applications. It simplifies common programming tasks such as manipulating arrays, objects, and strings. However, versions prior to 4.17.21 are susceptible to a command injection vulnerability through its template function, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2021-23337, arises from the way Lodash handles user input in its template function. Attackers can exploit this flaw to execute arbitrary commands on the server, potentially leading to unauthorized access, data breaches, or system compromise. The vulnerability affects all versions of Lodash prior to 4.17.21, making it critical for users to update to a secure version to mitigate risks.
How To Fix
Minimum fixed version
4.17.21+dfsg+~cs8.31.173-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-lodashTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing user inputs before passing them to the Lodash template function. This can help mitigate the risk of command injection. For example:
const _ = require('lodash');
function safeTemplate(templateString, data) {
// Sanitize inputs here
return _.template(templateString)(data);
}
Conclusion
CVE-2021-23337 represents a significant security risk for applications using vulnerable versions of Lodash. It is crucial for developers to upgrade to version 4.17.21 or later to protect their applications from potential command injection attacks. Implementing input sanitization can serve as a temporary measure while transitioning to a secure version.
See every vulnerability recorded for node-lodash →
FAQ
CVE-2021-23337 is a command injection vulnerability found in Lodash versions prior to 4.17.21, which can allow attackers to execute arbitrary commands.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-23337 is 7.2, indicating a high severity level.
If you cannot upgrade immediately, implement input sanitization as a temporary workaround to reduce the risk of exploitation.
You can find more information about Lodash and its features on its official GitHub repository at https://github.com/lodash/lodash.
Related vulnerabilities
Recent vulnerabilities recorded for node-lodash.
