CVE-2022-25171 Command Injection
Attackers can execute arbitrary commands via the run() function in the p4 npm library due to improper input sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25171?
CVE-2022-25171 is a high-severity command injection vulnerability in p4, published on 21 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization
Weakness: CWE-78
Which versions are affected by CVE-2022-25171?
2 open source packages ship an affected version, including p4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
p4 npm | All versions | 0.0.7 |
p4 npm | All versions | 0.0.7 |
Products include P4 Project P4.
How do I fix CVE-2022-25171?
Upgrade p4 to 0.0.7 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-25171 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-25171 exists.
Sources
Also known as GHSA-jfm8-hwhg-r6gg.