PT-2019-15885 · Strapi · Strapi

Slackr · Published 2019-12-05 · Updated 2021-12-10 · CVE-2019-19609

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Strapi framework versions prior to 3.0.0-beta.17.8

Description The issue allows for Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel. This is due to the lack of sanitization of the plugin name, enabling attackers to inject arbitrary shell commands. These commands are then executed by the execa function.

Recommendations For versions prior to 3.0.0-beta.17.8, update to version 3.0.0-beta.17.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the Install and Uninstall Plugin components of the Admin panel to minimize the risk of exploitation.

Exploit

Fix

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-20

CWE-77

Related Identifiers

CVE-2019-19609

GHSA-49VV-6Q7Q-W5CF

GHSA-9P2W-RMX4-9MW7

Affected Products

Strapi

References · 16

• 🔥 https://github.com/diego-tella/CVE-2019-19609-EXPLOIT · Exploit
• 🔥 https://github.com/ebadfd/CVE-2019-19609 · Exploit
• 🔥 https://github.com/z9fr/CVE-2019-19609 · Exploit
• 🔥 https://github.com/dasithsv/CVE-2019-19609 · Exploit
• 🔥 https://github.com/4ugury/CVE-2019-19609 · Exploit
• 🔥 http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/50238 · Exploit
• 🔥 https://bittherapy.net/post/strapi-framework-remote-code-execution · Exploit
• https://github.com/strapi/strapi/pull/4636 · Patch
• https://osv.dev/vulnerability/CVE-2019-19609 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p2w-rmx4-9mw7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19609 · Security Note
• https://osv.dev/vulnerability/GHSA-49vv-6q7q-w5cf · Vendor Advisory
• https://github.com/strapi/strapi · Note