Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-7606

CVE-2020-7606: OS Command Injection in docker-compose-remote-api

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-7606
GHSA ID
GHSA-q6pj-jh94-5fpr
EPSS Score
0.6142%
CWE
CWE-78
Published
5/7/2021
Updated
9/11/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
docker-compose-remote-apinpm<= 0.1.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability documentation explicitly identifies the exec function in index.js as the vulnerable component. Multiple sources (GitHub Advisory, NVD, Snyk) confirm that user-controlled serviceName parameter is passed directly to command execution without sanitization. The function's parameters and attack pattern match classic command injection scenarios where untrusted input flows into system commands. The PoC demonstrates command injection through serviceName parameter manipulation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*o*k*r-*ompos*-r*mot*-*pi t*rou** *.*.* *llows *x**ution o* *r*itr*ry *omm*n*s. Wit*in `in**x.js` o* t** p**k***, t** *un*tion `*x**(s*rvi**N*m*, *m*, *nSt*out, *nSt**rr, *n*xit)` us*s t** v*ri**l* `s*rvi**N*m*` w*i** **n ** *ontroll** *y us*rs wit*o

Reasoning

T** vuln*r**ility *o*um*nt*tion *xpli*itly i**nti*i*s t** `*x**` *un*tion in `in**x.js` *s t** vuln*r**l* *ompon*nt. Multipl* sour**s (*it*u* **visory, NV*, Snyk) *on*irm t**t us*r-*ontroll** `s*rvi**N*m*` p*r*m*t*r is p*ss** *ir**tly to *omm*n* *x**