PT-2021-24152 · Naholyr · Github-Todos

Dwisiswant0 · Published 2021-12-06 · Updated 2021-12-10 · CVE-2021-44684

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: naholyr github-todos version 3.1.0

Description: The issue concerns a command injection vulnerability. Specifically, the range argument for the hook subcommand is concatenated without validation and directly used by the exec function. This lack of validation allows for potential command injection attacks.

Recommendations: For naholyr github-todos version 3.1.0, consider disabling the hook subcommand until a patch is available to prevent exploitation of the command injection vulnerability. Restrict access to the exec function to minimize the risk of exploitation. Avoid using the range argument in the affected subcommand until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-44684

GHSA-792J-9WJ3-J634

Affected Products

Github-Todos

References · 9

• 🔥 https://github.com/dwisiswant0/advisory/issues/5 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44684 · Security Note
• https://osv.dev/vulnerability/GHSA-792j-9wj3-j634 · Vendor Advisory
• https://github.com/naholyr/github-todos/issues/34 · Note
• https://t.me/cvenotify/24412 · Telegram Post
• https://t.me/cibsecurity/33424 · Telegram Post
• https://t.me/cvenotify/24311 · Telegram Post
• https://advisory.dw1.io/5 · Note