Command Injection in addax
Summary
GHSA-4q8f-5xxj-946r: Command Injection in addax. Affects addax versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The addax package is an npm package used for a specific functionality. It is vulnerable to Command Injection in versions prior to 1.1.0. This vulnerability arises due to the lack of input validation in the presignPath function, which directly receives input from the API endpoint. Exploiting this vulnerability requires authentication, but if successful, it allows attackers to execute arbitrary commands on the system.
Vulnerability Detail
The Command Injection vulnerability in addax allows authenticated attackers to execute arbitrary commands on the system. By exploiting the lack of input validation in the presignPath function, an attacker can inject malicious commands that will be executed by the system. This can lead to unauthorized access, data leakage, or even complete compromise of the system.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
npm install addax@1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The addax package prior to version 1.1.0 is vulnerable to Command Injection. To mitigate this vulnerability, it is crucial to upgrade to version 1.1.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for addax →
FAQ
This vulnerability allows authenticated attackers to execute arbitrary commands on the system, potentially leading to unauthorized access, data leakage, or complete compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, exploiting this vulnerability requires authentication. Only authenticated users can access the API endpoint that allows injection of commands.
No specific workarounds have been mentioned for this vulnerability. It is recommended to upgrade to the fixed version of the addax package.
There are no known public exploits for this vulnerability at the moment.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
