Node.js-CVE-2024-39943

Vulnerabilità di esecuzione dei comandi in Node.js HFS CVE-2024-39943 White Hat School 3ª edizione – 노정민 @JenmrR Riepilogo In un ambiente server HFS basato su Node.js esiste una vulnerabilità che esegue il contenuto dei file caricati tramite childprocess.execSync. Un attaccante può eseguire...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...