PT-2022-10316 · Proctree · Proctree

Published 2022-06-01 · Updated 2022-06-09 · CVE-2021-34082

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions proctree versions through 0.1.1

Description The issue allows attackers to execute arbitrary commands via the fix function, which is a form of OS Command Injection. This can potentially lead to unauthorized access and execution of system commands.

Recommendations For versions through 0.1.1, consider disabling the fix function until a patch is available to prevent the execution of arbitrary commands.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-34082

GHSA-CV76-RV4H-4MQC

Affected Products

Proctree

References · 6

• 🔥 https://github.com/allenhwkim/proctree/blob/master/index.js#L46 · Exploit
• 🔥 https://advisory.checkmarx.net/advisory/CX-2021-4783 · Exploit
• https://osv.dev/vulnerability/CVE-2021-34082 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cv76-rv4h-4mqc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34082 · Security Note
• https://github.com/allenhwkim/proctree · Note