GHSA-4q8f-5xxj-946r Command Injection in addax
Authenticated attackers can execute arbitrary system commands via unvalidated input in the presignPath function of the addax library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4q8f-5xxj-946r?
GHSA-4q8f-5xxj-946r is a command injection vulnerability in addax, published on 3 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Versions of addax prior to 1.1.0 are vulnerable to Command Injection. The package does not validate user input on the presignPath function which receives input directly from the API endpoint. Exploiting the vulnerability requires authentication. This may allow attackers to run arbitrary commands in the system.
Recommendation
Upgrade to version 1.1.0 or later.
Which versions are affected by GHSA-4q8f-5xxj-946r?
2 open source packages ship an affected version, including addax.
| Package | Affected | Fixed in |
|---|---|---|
addax npm | All versions | 1.1.0 |
addax npm | All versions | 1.1.0 |
How do I fix GHSA-4q8f-5xxj-946r?
Upgrade addax to 1.1.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-4q8f-5xxj-946r being exploited?
There is no known exploitation of GHSA-4q8f-5xxj-946r in the wild and no public exploit code.