PT-2020-2799 · Npm · Npm-Programmatic

Published 2020-04-01 · Updated 2021-07-21 · CVE-2020-7614

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions npm-programmatic versions 0.0.0 through 0.0.12 All versions of npm-programmatic are affected, but since a range is specified, we prioritize the range provided by Mitre.

Description The issue is related to Command Injection in the npm-programmatic package. The packages and option properties are concatenated without validation and used directly by the 'exec' function, allowing an attacker to execute arbitrary code by sending a specially crafted malicious package. This may enable attackers to run arbitrary code in the system if the package name passed to the function is user-controlled.

Recommendations For npm-programmatic versions 0.0.0 through 0.0.12, consider using an alternative package until a fix is made available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

RCE

OS Command Injection

Weakness Enumeration

CWE-79

CWE-20

CWE-78

Related Identifiers

BDU:2020-02927

CVE-2020-7614

GHSA-426H-24VJ-QWXF

SNYK-JS-NPMPROGRAMMATIC-564115

Affected Products

Npm-Programmatic

References · 9

• 🔥 https://snyk.io/vuln/SNYK-JS-NPMPROGRAMMATIC-564115 · Exploit
• https://github.com/Manak/npm-programmatic/blob/master/index.js#L18 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-7614 · Security Note
• https://osv.dev/vulnerability/GHSA-426h-24vj-qwxf · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02927 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7614 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7614 · Note
• https://cybersecurity-help.cz/vdb/SB2020052008 · Note
• https://npmjs.com/advisories/1507 · Note