Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTQ5dnYtNnE3cS13NWNm

OS Command Injection in Strapi

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

Permalink: https://github.com/advisories/GHSA-49vv-6q7q-w5cf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTQ5dnYtNnE3cS13NWNm
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-49vv-6q7q-w5cf, CVE-2019-19609
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-19609
• https://github.com/strapi/strapi/pull/4636
• https://bittherapy.net/post/strapi-framework-remote-code-execution/
• http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
• https://github.com/advisories/GHSA-49vv-6q7q-w5cf

Repository: https://github.com/strapi/strapi
Blast Radius: 26.1

Affected Packages