Vulnerability Description
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Traceroute Project | Traceroute | <= 1.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc7PatchThird Party Advisory
- https://github.com/jaw187/node-traceroute/tagsThird Party Advisory
- https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-
- https://snyk.io/vuln/npm:traceroute:20160311ExploitThird Party Advisory
- https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceThird Party Advisory
- https://www.npmjs.com/advisories/1465Third Party Advisory
- https://www.npmjs.com/package/tracerouteProductThird Party Advisory
- https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-pExploitThird Party Advisory
- https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc7PatchThird Party Advisory
- https://github.com/jaw187/node-traceroute/tagsThird Party Advisory
- https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-
- https://snyk.io/vuln/npm:traceroute:20160311ExploitThird Party Advisory
- https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceThird Party Advisory
- https://www.npmjs.com/advisories/1465Third Party Advisory
- https://www.npmjs.com/package/tracerouteProductThird Party Advisory
FAQ
What is CVE-2018-21268?
CVE-2018-21268 is a vulnerability with a CVSS score of 10.0 (CRITICAL). The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be no...
How severe is CVE-2018-21268?
CVE-2018-21268 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-21268?
Check the references section above for vendor advisories and patch information. Affected products include: Traceroute Project Traceroute.