PT-2021-14489 · Prisma · @Prisma/Sdk

Erik Krogh Kristensen + 1 · Published 2021-04-06 · Updated 2022-04-26 · CVE-2021-21414

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions @prisma/sdk versions prior to 2.20.0 @prisma/sdk versions prior to 2.20.0-dev.29

Description This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. It only affects the getPackedPackage function, which is not advertised and only used for tests and building the CLI. No malicious code was found after checking the codebase. As of today, there are no known Prisma users or external consumers of the @prisma/sdk package who are affected by this security issue.

Recommendations For @prisma/sdk versions prior to 2.20.0, update to version 2.20.0 or later. For @prisma/sdk versions prior to 2.20.0-dev.29, update to version 2.20.0-dev.29 or later. As a temporary workaround, consider disabling the getPackedPackage function until a patch is available. Avoid using this function with untrusted input to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-21414

GHSA-PXCC-HJ8W-FMM7

Affected Products

@Prisma/Sdk

References · 9

• https://github.com/prisma/prisma/pull/6245 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21414 · Security Note
• https://osv.dev/vulnerability/GHSA-pxcc-hj8w-fmm7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21414 · Vendor Advisory
• https://github.com/prisma/prisma/security/advisories/GHSA-pxcc-hj8w-fmm7 · Note
• https://security.netapp.com/advisory/ntap-20210618-0003 · Note
• https://t.me/cvenotify/13902 · Telegram Post
• https://t.me/cvenotify/29339 · Telegram Post
• https://t.me/cvenotify/16531 · Telegram Post