PT-2021-12727 · Npm · Fs-Path

Chalker · Published 2021-03-04 · Updated 2021-03-25 · CVE-2020-8298

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: fs-path node module versions prior to 0.0.25

Description: The issue concerns command injection via user-supplied inputs through specific methods. The copy, copySync, remove, and removeSync methods are vulnerable to this type of attack.

Recommendations: For versions prior to 0.0.25, update to version 0.0.25 or later to resolve the issue. As a temporary workaround, consider restricting the use of the copy, copySync, remove, and removeSync methods until a patch is applied. Avoid using user-supplied inputs in these methods to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-8298

GHSA-8MRF-64FW-2X75

Affected Products

Fs-Path

References · 6

• 🔥 https://hackerone.com/reports/324491 · Exploit
• 🔥❌ https://github.com/pillys/fs-path/pull/6 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2020-8298 · Vendor Advisory
• ❌ https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7 · Patch, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2020-8298 · Security Note
• https://osv.dev/vulnerability/GHSA-8mrf-64fw-2x75 · Vendor Advisory