Command Injection in Node.js - CVE-2024-36138

Vulnerability identifier: #VU93879

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-36138

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper handling of batch files in child_process.spawn / child_process.spawnSync on Windows. An attacker can inject a malicious command line argument and achieve code execution even if the shell option is not enabled.

Note, the vulnerability exists due to incomplete fix for #VU88462 (CVE-2024-27980).

Node.js
Rational Developer for i RPG and COBOL + Modernization Tools, Java Edition
IBM Business Automation Workflow
EasyApache
IBM Cloud Transformation Advisor
IBM Spectrum Control
IBM Cloud Pak for Business Automation
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Web and Scripting Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Oracle GraalVM for JDK
Planning Analytics Local
IBM Cognos Controller
IBM InfoSphere Information Server
nodejs18-debugsource
nodejs18-devel
nodejs18-docs
nodejs18-debuginfo
nodejs18
npm18
corepack18
nodejs20-debugsource
nodejs20-docs
nodejs20-devel
npm20
nodejs20-debuginfo
nodejs20
corepack20

Install updates from vendor's website.

Node.js - addressed in versions 18.20.4, 20.15.1, 22.4.1
EasyApache - update to 4 2024-7-10
Planning Analytics Local - addressed in versions 2.0.0.99, 2.1.6
IBM Cloud Transformation Advisor - update to 3.10.1
IBM Spectrum Control - update to 5.4.12.1
IBM Cognos Controller - addressed in versions 11.0.1.4, 11.1.0.2
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
nodejs18-debugsource - addressed in versions 18.20.4-8.24.1, 18.20.4-150400.9.24.2
nodejs18-devel - addressed in versions 18.20.4-8.24.1, 18.20.4-150400.9.24.2
nodejs18-docs - addressed in versions 18.20.4-8.24.1, 18.20.4-150400.9.24.2
nodejs18-debuginfo - addressed in versions 18.20.4-8.24.1, 18.20.4-150400.9.24.2
nodejs18 - addressed in versions 18.20.4-8.24.1, 18.20.4-150400.9.24.2
npm18 - addressed in versions 18.20.4-8.24.1, 18.20.4-150400.9.24.2
corepack18 - update to 18.20.4-150400.9.24.2
nodejs20-debugsource - addressed in versions 20.15.1-150500.11.12.2, 20.15.1-150600.3.3.2
nodejs20-docs - addressed in versions 20.15.1-150500.11.12.2, 20.15.1-150600.3.3.2
nodejs20-devel - addressed in versions 20.15.1-150500.11.12.2, 20.15.1-150600.3.3.2
npm20 - addressed in versions 20.15.1-150500.11.12.2, 20.15.1-150600.3.3.2
nodejs20-debuginfo - addressed in versions 20.15.1-150500.11.12.2, 20.15.1-150600.3.3.2
nodejs20 - addressed in versions 20.15.1-150500.11.12.2, 20.15.1-150600.3.3.2
corepack20 - addressed in versions 20.15.1-150500.11.12.2, 20.15.1-150600.3.3.2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF037, 24.0.0-IF003

• https://nodejs.org/en/blog/vulnerability/july-2024-security-releases

• Multiple vulnerabilities in Node.js
• SUSE update for nodejs18
• SUSE update for nodejs18
• SUSE update for nodejs20
• SUSE update for nodejs20
• Multiple vulnerabilities in IBM Rational Developer for i RPG and COBOL + Modernization Tools, Java Edition
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in Oracle GraalVM for JDK
• Multiple vulnerabilities in cPanel EasyApache
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation