PT-2022-10317 · Google-It · Google-It

Published 2022-06-01 · Updated 2022-06-09 · CVE-2021-34083

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions google-it versions up to 1.6.2

Description The issue arises when using the 'Open in browser' option, where google-it unsafely concatenates the result's link retrieved from Google to a shell command. This potentially exposes the server to remote code execution (RCE).

Recommendations For versions up to 1.6.2, update to a version higher than 1.6.2 to resolve the issue. As a temporary workaround, consider disabling the 'Open in browser' option until a patch is available. Restrict access to the shell command functionality to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

OS Command Injection

Weakness Enumeration

CWE-74

CWE-78

Related Identifiers

CVE-2021-34083

GHSA-7XHV-MPJW-422F

Affected Products

Google-It

References · 7

• 🔥 https://github.com/PatNeedham/google-it/blob/v1.6.2/src/googleIt.js#L34 · Exploit
• 🔥 https://github.com/PatNeedham/google-it/blob/v1.6.2/lib/googleIt.js#L59 · Exploit
• 🔥 https://advisory.checkmarx.net/advisory/CX-2021-4777 · Exploit
• https://osv.dev/vulnerability/CVE-2021-34083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34083 · Security Note
• https://osv.dev/vulnerability/GHSA-7xhv-mpjw-422f · Vendor Advisory
• https://github.com/PatNeedham/google-it · Note