CVE-2024-27980

Description

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

CVSS Metrics

• v3.0•HIGH•Score: 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 1.41%• Percentile: 71%

Techniques & Countermeasures

• CWE-77•Improper Neutralization of Special Elements used in a Command ('Command Injection')

  The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected Systems

• chainguard•nodejs-16

  < 16.20.2-r16

• chainguard•nodejs-18

  < 18.20.2-r0

• chainguard•nodejs-20

  < 20.12.2-r0

• chainguard•nodejs-21

  < 21.7.3-r0

• wolfi•nodejs-16

  < 16.20.2-r16

• wolfi•nodejs-18

  < 18.20.2-r0

• wolfi•nodejs-20

  < 20.12.2-r0

• wolfi•nodejs-21

  < 21.7.3-r0

• nodejs•node

  ≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.* | ≥ 17.0, < 17.* | ≥ 18.0, < 18.20.2 | ≥ 19.0, < 19.* | ≥ 20.0, < 20.12.2 | ≥ 21.0, < 21.7.3

References (5)

• http://www.openwall.com/lists/oss-security/2024/04/10/15
• http://www.openwall.com/lists/oss-security/2024/07/11/6
• http://www.openwall.com/lists/oss-security/2024/07/19/3
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MZN6PFXHTCCUENAKZXTGWPKUAHI6E2W/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUWBYDVCUSCX7YWTBX75LADMCVYFBGKU/