PT-2015-4351 · Node.Js · Dns-Sync

Skx · Published 2015-02-28 · Updated 2018-07-26 · CVE-2014-9682

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dns-sync module versions prior to 0.1.1

Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function. This can be exploited by passing malicious input to the function, potentially leading to unauthorized command execution.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing the input to the resolve API function to prevent shell metacharacters from being executed. Restrict access to the resolve function to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2014-9682

GHSA-Q5PQ-PGRV-FH89

GHSA-WXVM-FH75-MPGR

Affected Products

Dns-Sync

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2014-9682 · Security Note
• https://osv.dev/vulnerability/GHSA-q5pq-pgrv-fh89 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wxvm-fh75-mpgr · Vendor Advisory
• https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d · Note
• https://github.com/skoranga/node-dns-sync · Note
• https://github.com/skoranga/node-dns-sync/issues/1 · Note
• http://openwall.com/lists/oss-security/2014/11/11/6 · Note
• https://github.com/advisories/GHSA-wxvm-fh75-mpgr · Note
• https://github.com/advisories/GHSA-q5pq-pgrv-fh89 · Note