CVE-2019-10777 OS command injection in aws-lambda
Attackers can execute arbitrary commands via unsanitized function names in the aws-lambda Node.js library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10777?
CVE-2019-10777 is a critical command injection vulnerability in aws-lambda, published on 8 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName".
Weakness: CWE-78
Which versions are affected by CVE-2019-10777?
2 open source packages ship an affected version, including aws-lambda. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aws-lambda npm | All versions | 1.0.5 |
aws-lambda npm | All versions | 1.0.5 |
Products include Amazon Aws Lambda.
How do I fix CVE-2019-10777?
Upgrade aws-lambda to 1.0.5 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-10777 being exploited?
There is no known exploitation of CVE-2019-10777 in the wild and no public exploit code.
Sources
Also known as GHSA-934x-72xh-5hrg.