Bug 2124534 (CVE-2019-15597) - CVE-2019-15597 node-df: unsanitized input may allow for a remote code execution
Summary: CVE-2019-15597 node-df: unsanitized input may allow for a remote code execution
Keywords:
Status: NEW
Alias: CVE-2019-15597
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2271562 2271563 2125070 2125071 2125072 2125073 2125074 2125075 2125076
Blocks: 2124535
TreeView+ depends on / blocked
 
Reported: 2022-09-06 12:49 UTC by Marian Rehak
Modified: 2024-03-26 09:20 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An RCE attack was found in node-df, allowing an attacker to inject code via unsanitized input. The issue occurs because user input is concatenated inside a command that will be executed without verification.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2022-09-06 12:49:08 UTC 
A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input. The issue occurs because a user input is concatenated inside a command that will be executed without any check.

Reference:

https://hackerone.com/reports/703412
Comment 2 Sage McTaggart 2022-09-08 20:09:27 UTC 
https://github.com/adriano-di-giovanni/node-df/pull/8 fixed here, no upstream fix.
Note You need to log in before you can comment on or make changes to this bug.