Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM5ajMtd3FwaC01eHg5

Command Injection in egg-scripts

Versions of egg-scripts before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line.

Example:
eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'

Recommendation

Update to version 2.8.1 or later.

Permalink: https://github.com/advisories/GHSA-c9j3-wqph-5xx9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM5ajMtd3FwaC01eHg5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: 7 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-c9j3-wqph-5xx9, CVE-2018-3786
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-3786
• https://github.com/eggjs/egg-scripts/pull/26
• https://hackerone.com/reports/388936
• https://github.com/advisories/GHSA-c9j3-wqph-5xx9
• https://www.npmjs.com/advisories/694
• https://github.com/eggjs/egg-scripts/blob/2.8.1/History.md
• https://github.com/eggjs/egg-scripts/commit/b98fd03d1e3aaed68004b881f0b3d42fe47341dd

Repository: https://github.com/eggjs/egg-scripts
Blast Radius: 32.3

Affected Packages