Improper Neutralization of Special Elements used in a Command in Shell-quote
概要
Improper Neutralization of Special Elements used in a Command in Shell-quote
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is [A-z] instead of the correct [A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2021-42740 node-shell-quote 修正版: 1.7.3+~1.7.1-1
- Ubuntu UBUNTU-CVE-2021-42740 node-shell-quote
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web npmjs.com