PT-2013-1313 · Node.Js · Node-Printer
Publicado
2013-06-28
·
Atualizado
2021-11-24
·
CVE-2014-3741
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
node-printer versions 0.0.1 and earlier
Description
The issue is related to the
printDirect function in the node-printer module, which allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command. This is due to a lack of input data sanitization. The vulnerability can be exploited to execute arbitrary commands. Researchers have demonstrated the potential for attacks, including DDoS, denial of service, and man-in-the-middle attacks, by exploiting vulnerabilities in printers. It is estimated that tens of thousands of devices are potentially vulnerable, with the most vulnerable devices found in countries such as Germany, Russia, France, Netherlands, and the United Kingdom.Recommendations
For node-printer versions 0.0.1 and earlier, update to version 0.0.2 or later. As a temporary workaround, consider disabling the
printDirect() function until a patch is available. Restrict access to the lpr command to minimize the risk of exploitation. Avoid using the lpr command in the affected API endpoint until the issue is resolved.Correção
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Node-Printer