PT-2021-11551 · Total.Js · Total.Js
Alessio Dellalibera
·
Published
2021-02-02
·
Updated
2021-07-21
·
CVE-2020-28494
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions:
total.js versions prior to 3.4.7
Description:
The issue occurs in the
image.pipe and image.stream functions due to the type parameter being used to build a command that is executed using child process.spawn with the option shell set to true, and because the type parameter is not properly sanitized. This leads to a command injection vulnerability.Recommendations:
For versions prior to 3.4.7, update to version 3.4.7 or later to resolve the issue. As a temporary workaround, consider disabling the
image.pipe and image.stream functions until a patch is available. Restrict access to these functions to minimize the risk of exploitation. Avoid using the type parameter in the affected functions until the issue is resolved.Exploit
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Total.Js