PT-2021-15475 · Unknown · Portkiller

Omnitaint · Published 2021-04-18 · Updated 2021-05-06 · CVE-2021-23379

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions portkiller versions all

Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is provided. This is caused by the use of the child process exec function without proper input sanitization.

Recommendations For all versions, consider disabling the use of the child process exec function until a proper fix is implemented, and ensure all user input is sanitized to prevent arbitrary command execution.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2021-23379

GHSA-R6FW-8M27-43C9

Affected Products

Portkiller

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-PORTKILLER-1078537 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-23379 · Security Note
• https://osv.dev/vulnerability/GHSA-r6fw-8m27-43c9 · Vendor Advisory
• https://npmjs.com/package/portkiller · Note
• https://t.me/cvenotify/13569 · Telegram Post
• https://github.com/indatawetrust/portkiller · Note
• https://github.com/indatawetrust/portkiller/blob/f1f1c5076d9c5d60e8dd3930e98d665d8191aa7a/index.js%23L10 · Note