CVE-2024-3566 Command injection vulnerability in programing languages on Microsoft Windows operating system.
Attackers can execute arbitrary commands on Windows systems via vulnerable programming language runtimes using CreateProcess.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3566?
CVE-2024-3566 is a critical command injection vulnerability in Nodejs Node.js, published on 10 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Weakness: CWE-77
Which versions are affected by CVE-2024-3566?
3 open source packages ship an affected version, including node, node-min and process. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | From 1.77.2 | 18.19.0 |
node-min Bitnami | From 1.77.2 | 18.20.5 |
process Hackage | From 1.0.0.0 | 1.6.23.0 |
Products include Haskell Process Library, Nodejs Node.js, Php Php, Rust-Lang Rust, Yt-Dlp Project Yt-Dlp.
How do I fix CVE-2024-3566?
Upgrade node to 18.19.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-3566 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3566 exists.
Sources
Also known as BIT-node-2024-3566, BIT-node-min-2024-3566, GHSA-9xch-xvj3-fmf3, HSEC-2024-0003, MINI-392m-8v5j-v4j8, MINI-hpmw-pxqr-xhgm.