Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU0OWYtNzNoaC1tajM4
Command Injection in gitlabhook
All versions of gitlabhook are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Permalink: https://github.com/advisories/GHSA-549f-73hh-mj38JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU0OWYtNzNoaC1tajM4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 5 years ago
Updated: over 1 year ago
CVSS Score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Percentage: 0.11347
EPSS Percentile: 0.95378
Identifiers: GHSA-549f-73hh-mj38, CVE-2019-5485
References:
- https://nvd.nist.gov/vuln/detail/CVE-2019-5485
- https://hackerone.com/reports/685447
- http://packetstormsecurity.com/files/154598/NPMJS-gitlabhook-0.0.17-Remote-Command-Execution.html
- https://github.com/advisories/GHSA-549f-73hh-mj38
Affected Packages
npm:gitlabhook
Dependent packages: 0Dependent repositories: 4
Downloads: 10 last month
Affected Version Ranges: <= 0.0.17
No known fixed version
All affected versions: 0.0.11, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17