Описание
Command Injection in egg-scripts
Versions of egg-scripts before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line.
Example:
eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'
Recommendation
Update to version 2.8.1 or later.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2018-3786
- https://github.com/eggjs/egg-scripts/pull/26
- https://github.com/eggjs/egg-scripts/commit/b98fd03d1e3aaed68004b881f0b3d42fe47341dd
- https://hackerone.com/reports/388936
- https://github.com/advisories/GHSA-c9j3-wqph-5xx9
- https://github.com/eggjs/egg-scripts/blob/2.8.1/History.md
- https://www.npmjs.com/advisories/694
Пакеты
Наименование
egg-scripts
npm
Затронутые версииВерсия исправления
< 2.8.1
2.8.1
Связанные уязвимости
CVSS3: 9.8
nvd
больше 7 лет назад
A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.