Code Injection in nim - CVE-2021-21372
Published: April 29, 2021
Vulnerability identifier: #VU52763
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2021-21372
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: nim-lang.org
Affected software:
nim
nim
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in Nimble doCmd when processing entries in the packages.json package. A remote attacker can create a specially crafted entry in the packages.json file, trick the victim into loading the malicious package file and execute arbitrary code on the system.
How to mitigate CVE-2021-21372
Install updates from vendor's website.
Sources
- https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
- https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
- https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37
- https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p