CVE-2020-15123 Command injection in codecov (npm package)
Command injection in codecov npm package allows attackers to execute arbitrary commands via unsanitized input in the upload method.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15123?
CVE-2020-15123 is a critical command injection vulnerability in codecov-node, published on 20 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.
Weakness: CWE-78
Which versions are affected by CVE-2020-15123?
2 open source packages ship an affected version, including codecov. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
codecov npm | All versions | 3.7.1 |
codecov npm | All versions | 3.7.1 |
Products include Codecov Codecov.
How do I fix CVE-2020-15123?
Upgrade codecov to 3.7.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-15123 being exploited?
There is no known exploitation of CVE-2020-15123 in the wild and no public exploit code.
Other vulnerabilities in codecov-node
Sources
Also known as GHSA-xp63-6vf5-xf3v.