PT-2024-5241 · Node.Js+2 · Node.Js+2
Tianst
·
Published
2024-02-29
·
Updated
2025-01-10
·
CVE-2024-27980
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Node.js versions 18.x, 20.x, and 21.x
Description:
The issue is related to the improper handling of batch files in
child process.spawn and child process.spawnSync on Windows platforms. This allows a malicious command line argument to inject arbitrary commands and achieve code execution, even if the shell option is not enabled. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.Recommendations:
For Node.js versions 18.x, 20.x, and 21.x, update to a version that includes the fix for this issue.
As a temporary workaround, consider disabling the
child process.spawn function until a patch is available.
Restrict access to the child process.spawnSync function to minimize the risk of exploitation.
Avoid using the args parameter in the affected child process.spawn function until the issue is resolved.Fix
OS Command Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Node.Js
Suse