Command Injection Vulnerability in php-shellcommand Package
Summary
CVE-2019-10774: php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. Affects php-shellcommand across 2 version ranges.
< 1.6.1-1
< 8d98d8536e05abafe76a491da87296d824939076
Fixed in 1.6.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The php-shellcommand package is a PHP library that allows users to execute shell commands in a safe and controlled manner. It is widely used in various applications to facilitate command execution without exposing the system to security risks. However, prior to version 1.6.1, the package was found to have a command injection vulnerability that could allow attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability, identified as CVE-2019-10774, originates from improper handling of user inputs in the php-shellcommand package. This flaw allows an attacker to inject malicious commands that the application may execute, leading to arbitrary code execution on the server. The severity of this vulnerability is rated with a CVSS score of 9.8, indicating a critical risk to systems utilizing affected versions of the package. Successful exploitation could compromise the integrity and confidentiality of the system, allowing unauthorized access and control.
How To Fix
Minimum fixed version
1.6.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-shellcommandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround involves sanitizing user inputs to prevent command injection. Ensure that any user-supplied data is properly validated and escaped before being passed to shell commands. This can be done by using functions like escapeshellarg() in PHP to escape arguments.
Conclusion
The php-shellcommand package has a critical command injection vulnerability that can lead to severe security risks. It is essential for users to upgrade to version 1.6.1 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for php-shellcommand →
FAQ
CVE-2019-10774 is a vulnerability in the php-shellcommand package that allows for command injection, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete control over the affected system.
Yes, you can sanitize user inputs to prevent command injection as a temporary measure until an upgrade can be performed.
The CVSS score for CVE-2019-10774 is 9.8, indicating a critical level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for php-shellcommand.
