PT-2021-14487 · Unknown · @Thi.Ng/Egf

Erik-Krogh · Published 2021-03-30 · Updated 2021-04-06 · CVE-2021-21412

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @thi.ng/egf versions prior to 0.4.0

Description The issue concerns arbitrary code execution in #gpg-tagged property values when the decrypt: true option is enabled. This is relevant only when GPG encrypted values are used or required, as the EGF parse functions do not attempt to decrypt values by default due to GPG's unavailability in browser environments.

Recommendations For versions prior to 0.4.0, update to version 0.4.0 or later to resolve the issue. As a temporary workaround, consider performing a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (`) chars in the encrypted value string, then replace or remove them, or skip parsing if present.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-21412

GHSA-RJ44-GPJC-29R7

Affected Products

@Thi.Ng/Egf

References · 8

• https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7 · Patch
• https://github.com/thi-ng/umbrella/commit/88f61656e5f5cfba960013b8133186389efaf243 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21412 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21412 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rj44-gpjc-29r7 · Vendor Advisory
• https://github.com/thi-ng/umbrella/blob/develop/packages/egf/CHANGELOG.md#040-2021-03-27 · Note
• https://npmjs.com/package/@thi.ng/egf · Note
• https://npmjs.com/package/%40thi.ng/egf · Note