scravy/node-macaddress · Security
Command Injection in macaddress
- GHSA ID
- GHSA-pp57-mqmh-44h7
- CVE ID
- CVE-2018-13797
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
All versions of macaddress are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the iface argument to the one method.
Recommendation
Update to version 0.2.9 or later.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-13797 ↗
- https://github.com/scravy/node-macaddress/pull/20 ↗
- https://hackerone.com/reports/319467 ↗
- https://github.com/advisories/GHSA-pp57-mqmh-44h7 ↗
- https://www.npmjs.com/advisories/654 ↗
- https://github.com/scravy/node-macaddress/pull/20/ ↗
- https://github.com/scravy/node-macaddress/commit/358fd594adb196a86b94ac9c691f69fe5dad2332 ↗
- https://github.com/scravy/node-macaddress/releases/tag/0.2.9 ↗
- https://news.ycombinator.com/item?id=17283394 ↗