PT-2020-8911 · Unknown · Traceroute

Published 2020-06-25 · Updated 2022-05-24 · CVE-2018-21268

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:L/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions traceroute (aka node-traceroute) versions through 1.0.0

Description The issue allows remote command injection via the host parameter. This occurs because the Child.exec() method is used, which is considered not entirely safe. An OS command can be placed after a newline character.

Recommendations For versions through 1.0.0, consider disabling the Child.exec() method until a patch is available. Restrict access to the host parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2018-21268

GHSA-8J9V-QHP4-WV55

Affected Products

Traceroute

References · 17

• 🔥 https://snyk.io/vuln/npm:traceroute:20160311 · Exploit
• 🔥 https://op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package · Exploit
• 🔥 https://medium.com/@shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3 · Exploit
• https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386f · Patch
• https://osv.dev/vulnerability/GHSA-8j9v-qhp4-wv55 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-21268 · Security Note
• https://osv.dev/vulnerability/CVE-2018-21268 · Vendor Advisory
• https://github.com/jaw187/node-traceroute/tags · Note
• https://github.com/jaw187/node-traceroute · Note
• https://linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-Rcpy · Note
• https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3 · Note
• https://npmjs.com/package/traceroute · Note
• https://t.me/cibsecurity/13165 · Telegram Post
• https://t.me/cibsecurity/13176 · Telegram Post
• https://t.me/cvenotify/4651 · Telegram Post