← Back to CVEs

CVE-2018-21268

CRITICAL

10.0

Description

The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.

CVE Details

CVSS v3.1 Score10.0

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published6/25/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

traceroute_project:traceroute

Weaknesses (CWE)

CWE-74

References

https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386f(cve@mitre.org)

https://github.com/jaw187/node-traceroute/tags(cve@mitre.org)

https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3(cve@mitre.org)

https://snyk.io/vuln/npm:traceroute:20160311(cve@mitre.org)

https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-Rcpy(cve@mitre.org)

https://www.npmjs.com/advisories/1465(cve@mitre.org)

https://www.npmjs.com/package/traceroute(cve@mitre.org)

https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package/(cve@mitre.org)

https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386f(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/jaw187/node-traceroute/tags(af854a3a-2127-422b-91ae-364da2661108)

https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3(af854a3a-2127-422b-91ae-364da2661108)

https://snyk.io/vuln/npm:traceroute:20160311(af854a3a-2127-422b-91ae-364da2661108)

https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-Rcpy(af854a3a-2127-422b-91ae-364da2661108)

https://www.npmjs.com/advisories/1465(af854a3a-2127-422b-91ae-364da2661108)

https://www.npmjs.com/package/traceroute(af854a3a-2127-422b-91ae-364da2661108)

https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.