Fix CVE–2018–13797

[debricked-staging]

CVE–2018–13797

Vulnerability details

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

GitHub

Command Injection in macaddress

All versions of macaddress are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the iface argument to the one method.

Recommendation

Update to version 0.2.9 or later.

NVD

The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.

GitLab Advisory Database (Open Source Edition)

OS Command Injection

The macaddress module is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    npm/node-macaddress/CVE-2018-13797.yml · main · GitLab.org / GitLab Advisory Database Open Source Edition · GitLab
    Command Injection in macaddress · CVE-2018-13797 · GitHub Advisory Database · GitHub
    NVD - CVE-2018-13797
    Merge pull request #20 from flypapertech/fixCommandInjection · scravy/node-macaddress@358fd59 · GitHub
    node-macaddress/lib/windows.js at dd079620d11c91957ac897e88d539dfceec41d56 · scravy/node-macaddress · GitHub
    node-macaddress/lib/unix.js at dd079620d11c91957ac897e88d539dfceec41d56 · scravy/node-macaddress · GitHub
    Fixes arbitrary command injection by using execFile instead of exec by Logikgate · Pull Request #20 · scravy/node-macaddress · GitHub
    node-macaddress/lib/macosx.js at dd079620d11c91957ac897e88d539dfceec41d56 · scravy/node-macaddress · GitHub
    node-macaddress/lib/linux.js at dd079620d11c91957ac897e88d539dfceec41d56 · scravy/node-macaddress · GitHub
    Release v0.2.9 · scravy/node-macaddress · GitHub
    node-macaddress/lib/windows.js at dd079620d11c91957ac897e88d539dfceec41d56 · scravy/node-macaddress · GitHub
    Critical vulnerability of NPM package macaddress | Hacker News
    Fixes arbitrary command injection by using execFile instead of exec by Logikgate · Pull Request #20 · scravy/node-macaddress · GitHub
    HackerOne
    Command Injection in macaddress · CVE-2018-13797 · GitHub Advisory Database · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE