OS Command Injection in node-rules - #VU28103
Published: May 20, 2020 / Updated: May 20, 2020
Vulnerability identifier: #VU28103
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to the application does not properly sanitize input rules and passes it directly to an eval call when using the fromJSON function. A remote attacker can send a specially crafted request to the application and execute arbitrary code in the system if the rules are user-controlled.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
node-rules
Remediation
Update to version 5.0.0.
node-rules - update to 5.0.0