CVE-2021-32090 Command injection in LocalStack
Attackers can execute arbitrary shell commands via the functionName parameter in the LocalStack dashboard component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32090?
CVE-2021-32090 is a critical command injection vulnerability in n/a, published on 7 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.
Weakness: CWE-78
Which versions are affected by CVE-2021-32090?
3 open source packages ship an affected version, including localstack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
localstack PyPI | All versions | 0.12.10 |
localstack PyPI | All versions | 0.12.10 |
localstack PyPI | All versions | 0.12.6.1 |
Products include Localstack Localstack.
How do I fix CVE-2021-32090?
Upgrade localstack to a fixed version for your release line: 0.12.10 or 0.12.6.1.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-32090 being exploited?
There is no known exploitation of CVE-2021-32090 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hpr6-f4vq-mxch, PYSEC-2021-101.