kyleross/windows-cpu · Security
Command Execution in windows-cpu
- GHSA ID
- GHSA-63m4-fhf2-cmf7
- CVE ID
- CVE-2017-1000219
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Version of windows-cpu before 0.1.5 will execute arbitrary code passed into the first argument of the findLoad method, resulting in remote code execution.
Proof of Concept
var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');
Recommendation
Update to version 0.1.5 or later.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')