CVE-2021-34083 Command injection in google-it
An attacker can execute arbitrary commands on the server by exploiting unsafe shell command concatenation in the 'Open in browser' feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34083?
CVE-2021-34083 is a high-severity command injection vulnerability in n/a, published on 1 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially exposing the server to RCE.
Weakness: CWE-78
Which versions are affected by CVE-2021-34083?
2 open source packages ship an affected version, including google-it. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
google-it npm | All versions to 1.6.2 | None |
google-it npm | All versions to 1.6.2 | None |
Products include Google-It Project Google-It.
How do I fix CVE-2021-34083?
No fix has been published for CVE-2021-34083 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-34083 being exploited?
There is no known exploitation of CVE-2021-34083 in the wild and no public exploit code.
Sources
Also known as GHSA-7xhv-mpjw-422f.