SB20240708108 - OS Command Injection in rejetto HFS

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: CVE-2024-39943)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary commands on the underlying operating system.

The vulnerability exists due to command injection in the execSync command execution logic when executing shell commands. A remote user can send crafted input to execute arbitrary commands on the underlying operating system.

Remediation

Install update from vendor's website.

References

• https://security.snyk.io/vuln/SNYK-JS-HFS-7430254
• https://github.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad1d