PT-2015-4351 · Node.Js · Dns-Sync

Skx · Publicado 2015-02-28 · Atualizado 2018-07-26 · CVE-2014-9682

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dns-sync module versions prior to 0.1.1

Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function. This can be exploited by passing malicious input to the function, potentially leading to unauthorized command execution.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing the input to the resolve API function to prevent shell metacharacters from being executed. Restrict access to the resolve function to minimize the risk of exploitation.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2014-9682

GHSA-Q5PQ-PGRV-FH89

GHSA-WXVM-FH75-MPGR

Produtos afetados

Dns-Sync

Referências · 9

• https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d · Nota
• https://github.com/skoranga/node-dns-sync · Nota
• https://github.com/skoranga/node-dns-sync/issues/1 · Nota
• http://openwall.com/lists/oss-security/2014/11/11/6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9682 · Nota de Segurança
• https://github.com/advisories/GHSA-wxvm-fh75-mpgr · Nota
• https://github.com/advisories/GHSA-q5pq-pgrv-fh89 · Nota
• https://osv.dev/vulnerability/GHSA-q5pq-pgrv-fh89 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wxvm-fh75-mpgr · Aviso do Fabricante