PT-2020-6944 · Unknown · Strong-Nginx-Controller

Published 2020-04-02 · Updated 2022-02-10 · CVE-2020-7621

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions strong-nginx-controller versions 1.0.2 and earlier

Description The issue allows for the execution of arbitrary commands as part of the nginxCmd() function, due to a lack of measures to neutralize special elements. This can enable a remote attacker to execute arbitrary commands.

Recommendations For strong-nginx-controller versions 1.0.2 and earlier, as a temporary workaround, consider disabling the nginxCmd() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-07941

CVE-2020-7621

GHSA-4V9W-PVWR-38H3

SNYK-JS-STRONGNGINXCONTROLLER-564248

Affected Products

Strong-Nginx-Controller

References · 7

• https://bdu.fstec.ru/vul/2023-07941 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7621 · Security Note
• https://osv.dev/vulnerability/GHSA-4v9w-pvwr-38h3 · Vendor Advisory
• https://github.com/strongloop/strong-nginx-controller/blob/master/lib/server.js#L65, · Note
• https://github.com/strongloop/strong-nginx-controller/blob/master/lib/server.js#L65%2C · Note
• https://snyk.io/vuln/SNYK-JS-STRONGNGINXCONTROLLER-564248 · Note