CVE-2020-28429

HIGHNuclei

Command Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2020-28429 has a selected CVSS score of 7.3 (high); EIP currently links 1 Nuclei template.

Description

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

geojson2kml

CVE ListVersion range not suppliedaffected

geojson2kml

Browse npm / geojson2kml
GitHub AdvisoryThrough 0.1.1affected

Nuclei templates

1
ProjectDiscoveryCRITICALgeojson2kml - Command InjectionCVSS 9.8

Detects command injection vulnerability by checking if `hacked.txt` is created and contains the expected content.

Impact

Successful exploitation of this vulnerability could result in unauthorized access, remote code execution, privilege escalation

Remediation

Do not use geojson2kml. There is no fixed version for geojson2kml.

WeaknessesCWE-78
Authorseeche, chae1xx1os, persona-twotwo, soonghee2
Template tagscvecve2020rcegeojson2kmlfile-uploadintrusivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:geojson2kml_project:geojson2kml:*:*:*:*:*:node.js:*:*
https://snyk.io/vuln/SNYK-JS-GEOJSON2KML-1050412 https://github.com/advisories/GHSA-w83x-fp72-p9qc https://nvd.nist.gov/vuln/detail/CVE-2020-28429

Source: ProjectDiscovery

References

2