Lucene search
TianstH1:2461831HistoryApr 13, 2024 - 10:23 a.m.
Node.js: Bypass incomplete fix of CVE-2024-27980
2024-04-1310:23:14
tianst
hackerone.com
21
node.js
security
vulnerability
cve-2024-27980
windows
batch files
code execution
child_process.spawn
child_process.spawnsync
bugbounty
The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
This vulnerability affects all users of child_process.spawn and child_process.spawnSync on Windows in all active release lines.
Related
cvelist
cvelist
CVE-2024-36138
2024-09-07 16:00:36
alpinelinux
alpinelinux
CVE-2024-36138
2024-09-07 16:15:02
osv
osv
CVE-2024-36138
2024-09-07 16:15:02
BIT-node-2024-36138
2024-09-10 07:13:39
CGA-5qcv-f6cg-wpcw
2024-06-06 12:24:15
vulnrichment
vulnrichment
CVE-2024-36138
2024-09-07 16:00:36
nvd
nvd
CVE-2024-36138
2024-09-07 16:15:02
debiancve
debiancve
CVE-2024-36138
2024-09-07 16:15:02
CVE-2024-27980
2024-04-10 21:31:10
cve
cve
CVE-2024-36138
2024-09-07 16:15:02
nessus
nessus
SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2024:2496-1)
2024-07-17 00:00:00
SUSE SLES15 / openSUSE 15 Security Update : nodejs18 (SUSE-SU-2024:2542-1)
2024-07-18 00:00:00
Fedora 39 : nodejs18 (2024-8d548b8c96)
2024-04-20 00:00:00
openvas
openvas
Node.js < 18.20.4, 19.x < 20.15.1, 21.x < 22.4.1 Multiple Vulnerabilities - Mac OS X
2024-06-27 00:00:00
Node.js < 18.20.4, 19.x < 20.15.1, 21.x < 22.4.1 Multiple Vulnerabilities - Windows
2024-06-27 00:00:00
Fedora: Security Advisory (FEDORA-2024-2c52524694)
2024-05-27 00:00:00
ibm
ibm
ubuntucve
ubuntucve
CVE-2024-36138
2024-07-11 00:00:00
CVE-2024-27980
2024-04-12 00:00:00
wolfi
wolfi
CVE-2024-27980 vulnerabilities
2024-09-19 09:11:50
fedora
fedora
[SECURITY] Fedora 39 Update: nodejs18-18.20.2-1.fc39
2024-04-20 01:03:34
[SECURITY] Fedora 40 Update: nodejs18-18.20.2-1.fc40
2024-04-19 21:44:23
nodejsblog
nodejsblog
Wednesday, April 10, 2024 Security Releases
2024-04-10 00:00:00
Monday, July 8, 2024 Security Releases
2024-07-08 00:00:00
redhatcve
redhatcve
CVE-2024-27980
2024-04-15 14:55:28
cgr
cgr
CVE-2024-27980 vulnerabilities
2024-05-19 03:07:16
f5
f5
K000141047: Multiple Node.js vulnerabilities
2024-09-12 00:00:00
mageia
mageia
Updated nodejs & yarnpkg packages fix security vulnerabilities
2024-08-28 20:11:44
photon
photon
Important Photon OS Security Update - PHSA-2024-4.0-0653
2024-07-16 00:00:00
Important Photon OS Security Update - PHSA-2024-5.0-0318
2024-07-16 00:00:00
thn
thn
Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks
2024-04-10 03:05:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00