Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-36377

CVE-2020-36377:
Vulnerability in dump function leads to arbitrary code execution via filePath parameters

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-36377
GHSA ID
GHSA-r496-7hgp-53wf
EPSS Score
0.77242%
CWE
CWE-77
Published
11/2/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
aaptjsnpm<= 1.3.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. The vulnerability description explicitly mentions the dump function as the entry point
  2. The GitHub issue #2 shows code using exec() with user-controlled cmd parameter
  3. CWE-78 (OS Command Injection) directly matches the pattern of unsanitized input passed to exec()
  4. The line number reference in the GitHub issue points to insecure command execution pattern
  5. The filePath parameter is specifically called out as the injection vector in both CVE and GHSA descriptions

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**ptjs is * no** wr*p*r *or **pt. *n issu* w*s *is*ov*r** in t** *ump *un*tion in s**nz*im **ptjs *.*.*, *llows *tt**k*rs to *x**ut* *r*itr*ry *o** vi* t** *il*P*t* p*r*m*t*rs.

Reasoning

*. T** vuln*r**ility **s*ription *xpli*itly m*ntions t** *ump *un*tion *s t** *ntry point *. T** *it*u* issu* #* s*ows *o** usin* *x**() wit* us*r-*ontroll** *m* p*r*m*t*r *. *W*-** (OS *omm*n* Inj**tion) *ir**tly m*t***s t** p*tt*rn o* uns*nitiz** i