#VU28103 OS Command Injection in node-rules

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28103

#VU28103 OS Command Injection in node-rules

Published: May 20, 2020 / Updated: May 20, 2020


Vulnerability identifier: #VU28103
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
node-rules
Software vendor:
Mithun Satheesh

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to the application does not properly sanitize input rules and passes it directly to an eval call when using the fromJSON function. A remote attacker can send a specially crafted request to the application and execute arbitrary code in the system if the rules are user-controlled.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Update to version 5.0.0.

External links