PT-2018-16203 · Egg · Egg-Scripts

Pontus_Johnson · Publicado 2018-08-24 · Atualizado 2023-02-02 · CVE-2018-3786

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions egg-scripts versions prior to 2.8.1

Description A command injection issue allows arbitrary shell command execution through a maliciously crafted command line argument. This is only exploitable if a malicious argument is provided on the command line. For example, an attacker could use the eggctl start --daemon --stderr command with a malicious stderr argument, such as '/tmp/eggctl stderr.log; touch /tmp/malicious', to execute arbitrary shell commands.

Recommendations Update to version 2.8.1 or later.

Exploit

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2018-3786

GHSA-C9J3-WQPH-5XX9

Produtos afetados

Egg-Scripts

Referências · 9

• 🔥 https://hackerone.com/reports/388936 · Exploit
• https://github.com/eggjs/egg-scripts/blob/2.8.1/History.md · Nota
• https://github.com/eggjs/egg-scripts/pull/26 · Correção
• https://github.com/eggjs/egg-scripts/commit/b98fd03d1e3aaed68004b881f0b3d42fe47341dd · Nota
• https://osv.dev/vulnerability/CVE-2018-3786 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-c9j3-wqph-5xx9 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-3786 · Nota de Segurança
• https://npmjs.com/advisories/694 · Nota
• https://github.com/advisories/GHSA-c9j3-wqph-5xx9 · Nota