CVE-2019-15597

EUVD-2020-0319 · Published Feb 14, 2020

Command Injection in node-df All versions of `node-df` are vulnerable to Command Injection. The package fails to sanitize filenames passed to the `file` option. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. ## Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Technologies

Node-Df_Project Node-DfNode-Df Node-Df

Weaknesses

CWE-94

CVSS scores

v3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Stealth

T1190Exploit Public-Facing Application T1027.006HTML Smuggling T1027.009Embedded Payloads T1564.009Resource Forking

References

https://hackerone.com/reports/703412
https://nvd.nist.gov/vuln/detail/CVE-2019-15597
https://github.com/adriano-di-giovanni/node-df
https://www.npmjs.com/advisories/1431

Potentially impacted assets

See if this affects your attack surface