PT-2018-17490 · Facebook · React-Dev-Utils

Acdlite · Published 2018-12-31 · Updated 2021-03-25 · CVE-2018-6342

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions react-dev-utils versions 1.x.x through 1.0.3 react-dev-utils versions 2.x.x through 2.0.1 react-dev-utils versions 3.x.x through 3.1.1 react-dev-utils versions 4.x.x through 4.2.1 react-dev-utils versions 5.x.x through 5.0.1

Description The issue allows an attacker to execute arbitrary commands on a targeted system by making a network request to the server, potentially via CSRF or direct request, due to improper sanitization of input to a command that launches an editor.

Recommendations Update to version 1.0.4 for the 1.x.x release line. Update to version 2.0.2 for the 2.x.x release line. Update to version 3.1.2 for the 3.x.x release line. Update to version 4.2.2 for the 4.x.x release line. Update to version 5.0.2 for the 5.x.x release line. As a temporary workaround, consider restricting access to the vulnerable command that launches an editor until a patch is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-6342

GHSA-29GP-92WP-94Q8

Affected Products

React-Dev-Utils

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-6342 · Security Note
• https://osv.dev/vulnerability/GHSA-29gp-92wp-94q8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-6342 · Vendor Advisory
• https://github.com/facebook/create-react-app/pull/4866 · Note
• https://github.com/facebook/create-react-app/releases/tag/v1.1.5 · Note
• https://github.com/facebook/create-react-app · Note
• https://github.com/advisories/GHSA-29gp-92wp-94q8 · Note
• https://npmjs.com/advisories/695 · Note