Homepage
About Snyk

Arbitrary Command Injection Affecting network package, versions <0.7.0

0.0
high

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.07% (29th percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-NETWORK-6184371
  • published 29 Jan 2024
  • disclosed 23 Jan 2024
  • credit NodeMedic
Report a new vulnerability Found a mistake?

Introduced: 23 Jan 2024

CVE-2024-21488 Open this link in a new tab
CWE-77 Open this link in a new tab
First added by Snyk

How to fix?

Upgrade network to version 0.7.0 or higher.

Overview

network is a the missing network utilities in Node.js.

Affected versions of this package are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

PoC 

var PUT = require('network');
var x0 = " $(touch /tmp/success) # \" || touch /tmp/success # ' || touch /tmp/success";
var x1 = "{}";
new PUT["mac_address_for"](x0,x1);