Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-28443

CVE-2020-28443: sonar-wrapper Command Injection vulnerability

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-28443
GHSA ID
GHSA-wr4v-3f2h-6hhh
EPSS Score
0.35335%
CWE
CWE-77
Published
7/26/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
sonar-wrappernpm<= 0.1.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. The vulnerability description explicitly mentions lib/sonarRunner.js as the injection point
  2. The Snyk PoC demonstrates exploitation through the runAnalisys function
  3. The function name contains a typo ('Analisys') matching the PoC code
  4. Command injection typically occurs when user input is directly interpolated into system commands
  5. The options parameter is shown accepting untrusted input that gets executed as part of OS commands

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *omm*n* inj**tion vuln*r**ility *****ts *ll v*rsions o* p**k*** son*r-wr*pp*r. T** inj**tion point is lo**t** in li*/son*rRunn*r.js.

Reasoning

*. T** vuln*r**ility **s*ription *xpli*itly m*ntions li*/son*rRunn*r.js *s t** inj**tion point *. T** Snyk Po* **monstr*t*s *xploit*tion t*rou** t** run*n*lisys *un*tion *. T** *un*tion n*m* *ont*ins * typo ('*n*lisys') m*t**in* t** Po* *o** *. *omm*