Command Injection Affecting image-tiler package, versions <2.0.2
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.19% (58th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-IMAGETILER-1051029
- published 6 Jan 2021
- disclosed 14 Dec 2020
- credit JHU System Security Lab
Introduced: 14 Dec 2020
CVE-2020-28451 Open this link in a new tabHow to fix?
Upgrade image-tiler to version 2.0.2 or higher.
Overview
image-tiler is a package that creates zoom tile pyramids from a large image. There are other packages very similar to this one, but none did exactly what I needed, so I made mine.
Affected versions of this package are vulnerable to Command Injection.
PoC
var tile = require("image-tiler").tile;
var tilePromise = tile("& touch 1112","& touch 222","& touch 33",{invertZoom:true});
References
CVSS Scores
version 3.1