Bug 1936805 (CVE-2021-24033)

Summary:	CVE-2021-24033 nodejs-react-dev-utils: function getProcessForPort concatenates input argument into a command string
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alazarot, alegrand, anpicker, anstephe, bmontgom, emingora, eparis, erooth, etirelli, gghezzo, gparvin, ibek, jburrell, jokerman, jramanat, jrokos, jstastny, jweiser, jwendell, kakkoyun, kconner, krathod, kverlaen, lcosic, mnovotny, nstielau, pjindal, pkrupa, rcernich, rguimara, rrajasek, sponnaga, stcannon, surbania, thee, twalsh, tzimanyi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-react-dev-utils 11.0.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-24 11:35:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1936806

Description Michael Kaplan 2021-03-09 08:23:18 UTC

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.

Comment 1 Michael Kaplan 2021-03-09 08:23:24 UTC

External References:

https://github.com/facebook/create-react-app/pull/10644
https://www.facebook.com/security/advisories/cve-2021-24033

Comment 2 Przemyslaw Roguski 2021-03-12 13:27:40 UTC

The react-dev-utils package exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. If you use the react-dev-utils as a part of the react-scripts then you are not affected by this flaw. 

Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection.

In OpenShift Container Platform and OpenShift Service Mesh the react-dev-utils is used only during the build process and it's used within react-scripts, hence these products are not affected by this flaw.

Comment 3 Product Security DevOps Team 2021-03-24 11:35:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-24033