PT-2022-3577 · Npm · Npm-Dependency-Versions

Xiaofen9 · Published 2022-04-12 · Updated 2023-08-08 · CVE-2022-29080

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions npm-dependency-versions versions 0.3.0 and earlier

Description The issue is related to insufficient argument checking in the npm-dependency-versions package, which can lead to command injection. An attacker can exploit this by calling dependencyVersions with a JSON object containing a pkgs key and shell metacharacters in a value, potentially allowing remote execution of arbitrary commands.

Recommendations For versions 0.3.0 and earlier, consider disabling the dependencyVersions function until a patch is available to prevent command injection attacks. Restrict access to the dependencyVersions function to minimize the risk of exploitation. Avoid using the pkgs key in the JSON object passed to the dependencyVersions function until the issue is resolved.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2022-04361

CVE-2022-29080

GHSA-M7XQ-8JP8-RJ2C

Affected Products

Npm-Dependency-Versions

References · 8

• 🔥 https://github.com/barneycarroll/npm-dependency-versions/issues/6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29080 · Security Note
• https://osv.dev/vulnerability/GHSA-m7xq-8jp8-rj2c · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04361 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29080 · Vendor Advisory
• https://github.com/barneycarroll/npm-dependency-versions · Note
• https://npmjs.com/package/npm-dependency-versions · Note
• https://t.me/cibsecurity/40594 · Telegram Post