PT-2021-19658 · Stacklift · Localstack

Dennis Brinkrolf · Published 2021-05-07 · Updated 2025-03-06 · CVE-2021-32090

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: StackLift LocalStack version 0.12.6

Description: The issue allows attackers to inject arbitrary shell commands via the functionName parameter in the dashboard component. This could potentially lead to unauthorized access and execution of malicious commands.

Recommendations: For StackLift LocalStack version 0.12.6, consider restricting access to the dashboard component to minimize the risk of exploitation. Avoid using the functionName parameter in the affected dashboard component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2021-32090

GHSA-HPR6-F4VQ-MXCH

PYSEC-2021-101

Affected Products

Localstack

References · 12

• 🔥 https://portswigger.net/daily-swig/localstack-zero-day-vulnerabilities-chained-to-achieve-remote-takeover-of-local-instances · Exploit
• 🔥 https://blog.sonarsource.com/hack-the-stack-with-localstack · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-32090 · Security Note
• https://osv.dev/vulnerability/GHSA-hpr6-f4vq-mxch · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-101 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32090 · Vendor Advisory
• https://github.com/localstack/localstack/commit/01cd169ae5d077693d4c1a4679a95e30b8d44d54 · Note
• https://github.com/localstack/localstack · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/localstack/PYSEC-2021-101.yaml · Note
• https://twitter.com/unknownseeker99/status/1897734407651574259 · Twitter Post
• https://t.me/cvenotify/14223 · Telegram Post
• https://github.com/advisories/GHSA-hpr6-f4vq-mxch · Note