Arbitrary Command Injection Affecting @hoppscotch/cli package, versions <0.8.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-HOPPSCOTCHCLI-6672898
- published 24 Apr 2024
- disclosed 22 Apr 2024
- credit oskar-zeinomahmalat-sonarsource, mufeedvh
Introduced: 22 Apr 2024
CVE-2024-34347 Open this link in a new tabHow to fix?
Upgrade @hoppscotch/cli to version 0.8.0 or higher.
Overview
@hoppscotch/cli is an A CLI to run Hoppscotch test scripts in CI environments.
Affected versions of this package are vulnerable to Arbitrary Command Injection due to the improper handling of user-supplied input in the vm module context. An attacker can execute arbitrary system commands on the victim's machine by crafting a malicious pre-request script that escapes the sandbox environment.
Note
This is only exploitable if the victim downloads and runs a malicious Hoppscotch collection with the CLI tool.
Workaround
This vulnerability can be mitigated by using alternative safe JavaScript sandboxing libraries or by introducing an --enable-scripting flag for the CLI and disabling scripting by default.
PoC
outside = pw.constructor.constructor('return this')()
outside.process.mainModule.require('child_process').execSync('id > /tmp/pwnd')