PT-2019-14301 · Npm · Node-Df

Publicado 2019-12-18 · Atualizado 2021-10-29 · CVE-2019-15597

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions node-df versions 0.1.4 and earlier

Description A code injection issue exists that can allow an attacker to achieve remote code execution through unsanitized input. The package fails to sanitize filenames passed to the file option, which may allow attackers to run arbitrary commands in the server if the value is user-controlled.

Recommendations For node-df version 0.1.4, consider using an alternative package until a fix is made available. For all versions of node-df, consider restricting the use of the file option to prevent user-controlled input from being passed to it until a fix is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-15597

GHSA-WP7M-MRVF-599C

Produtos afetados

Node-Df

Referências · 7

• 🔥 https://hackerone.com/reports/703412 · Exploit
• https://github.com/adriano-di-giovanni/node-df · Nota
• https://osv.dev/vulnerability/CVE-2019-15597 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wp7m-mrvf-599c · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15597 · Nota de Segurança
• https://npmjs.com/advisories/1431 · Nota
• https://t.me/cvenotify/22647 · Publicação no Telegram