PT-2021-2030 · Xopen · Xopen

Published 2021-02-01 · Updated 2022-08-01 · CVE-2020-28447

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: xopen versions all

Description: The issue is related to a command injection vulnerability in the xopen(filepath) function. This vulnerability exists due to the lack of neutralization of special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to execute arbitrary operating system commands by sending specially crafted data. The injection point is located in line 14 in index.js in the exported function xopen(filepath).

Recommendations: For all versions, consider disabling the xopen(filepath) function until a patch is available to prevent exploitation. Restrict access to the xopen package to minimize the risk of exploitation. Avoid using the xopen function in sensitive operations until the issue is resolved.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2021-00866

CVE-2020-28447

GHSA-74WF-CWJG-9CF2

Affected Products

Xopen

References · 9

• 🔥 https://security.snyk.io/vuln/SNYK-JS-XOPEN-1050981 · Exploit
• https://osv.dev/vulnerability/GHSA-74wf-cwjg-9cf2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28447 · Security Note
• https://bdu.fstec.ru/vul/2021-00866 · Security Note
• https://github.com/andrewimm/xopen/blob/master/index.js · Note
• https://github.com/andrewimm/xopen · Note
• https://cybersecurity-help.cz/vdb/SB2021020106 · Note
• https://npmjs.com/package/xopen · Note
• https://snyk.io/vuln/SNYK-JS-XOPEN-1050981 · Note