CVE-2021-24033 react-dev-utils OS Command Injection in function `getProcessForPort`
Attackers can execute arbitrary commands if custom code passes user input to the getProcessForPort function in react-dev-utils.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-24033?
CVE-2021-24033 is a medium-severity command injection vulnerability in Facebook react-dev-utils, published on 9 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Weakness: CWE-78
Which versions are affected by CVE-2021-24033?
2 open source packages ship an affected version, including react-dev-utils. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
react-dev-utils npm | From 0.4.0 | 11.0.4 |
react-dev-utils npm | From 0.4.0 | 11.0.4 |
Products include Facebook React-Dev-Utils.
How do I fix CVE-2021-24033?
Upgrade react-dev-utils to 11.0.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-24033 being exploited?
There is no known exploitation of CVE-2021-24033 in the wild and no public exploit code.
Other vulnerabilities in Facebook react-dev-utils
Sources
Also known as GHSA-5q6m-3h65-w53x.