PT-2021-15454 · Madge · Madge

Alessio Della Libera + 1 · Published 2021-03-09 · Updated 2021-03-13 · CVE-2021-23352

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions madge versions prior to 4.0.1

Description The issue affects the madge package, allowing an attacker to specify a custom Graphviz path via the graphVizPath option parameter. When the .image(), .svg(), or .dot() functions are called, the specified path is executed by the childprocess.exec function. This could potentially lead to arbitrary command execution.

Recommendations For madge versions prior to 4.0.1, consider disabling the childprocess.exec function or restricting the use of the graphVizPath option parameter until a patch is available. Avoid using the graphVizPath option parameter in the affected API endpoints until the issue is resolved. Update to version 4.0.1 or later to resolve the issue.

Exploit

Fix

SQL injection

Command Injection

Weakness Enumeration

CWE-89

CWE-77

Related Identifiers

CVE-2021-23352

GHSA-753C-PHHG-CJ29

SNYK-JS-MADGE-1082875

Affected Products

Madge

References · 10

• 🔥 https://snyk.io/vuln/SNYK-JS-MADGE-1082875 · Exploit
• https://github.com/pahen/madge/commit/da5cbc9ab30372d687fa7c324b22af7ffa5c6332 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23352 · Security Note
• https://osv.dev/vulnerability/GHSA-753c-phhg-cj29 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23352 · Vendor Advisory
• https://github.com/pahen/madge/blob/master/lib/graph.js%23L27 · Note
• https://github.com/pahen/madge/blob/master/lib/graph.js#L27 · Note
• https://t.me/cvenotify/11049 · Telegram Post
• https://t.me/cibsecurity/24656 · Telegram Post
• https://t.me/cvenotify/11291 · Telegram Post