CVE-2019-19609 Command Injection in strapi

What is CVE-2019-19609?

CVE-2019-19609 is a high-severity command injection vulnerability in n/a, published on 5 Dec 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

Weakness: CWE-78

Which versions are affected by CVE-2019-19609?

2 open source packages ship an affected version, including strapi. It affects 1 product.

Products include Strapi Strapi.

How do I fix CVE-2019-19609?

Upgrade strapi to 3.0.0-beta.17.8 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-19609 being exploited?

There is no known exploitation of CVE-2019-19609 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 7 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Exploited High 7.2
• CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin Critical 10.0
• CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi Critical 9.8
• CVE-2020-27664 Authorization bypass in Strapi Critical 9.8
• CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9p2w-rmx4-9mw7.