PT-2022-10318 · Turistforeningen · Node-S3-Uploader

Published 2022-06-01 · Updated 2022-06-09 · CVE-2021-34084

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Turistforeningen node-s3-uploader versions prior to 2.0.4

Description The issue allows attackers to execute arbitrary commands via the metadata() function, which is a part of the node-s3-uploader for Node.js. This can be exploited by providing malicious input to the metadata() function.

Recommendations For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the metadata() function until a patch is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-34084

GHSA-GWP3-F7MR-QPFV

Affected Products

Node-S3-Uploader

References · 5

• 🔥 https://advisory.checkmarx.net/advisory/CX-2021-4776 · Exploit
• https://osv.dev/vulnerability/CVE-2021-34084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34084 · Security Note
• https://osv.dev/vulnerability/GHSA-gwp3-f7mr-qpfv · Vendor Advisory
• https://github.com/Turistforeningen/node-s3-uploader · Note