Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-7623

CVE-2020-7623: OS Command Injection in jscover

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-7623
GHSA ID
GHSA-c5hm-xc74-pqrg
EPSS Score
0.8066%
CWE
CWE-78
Published
2/10/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
jscovernpm<= 1.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability occurs in the command construction at line 59 and subsequent execution via child_process.exec. The code builds a Java command string (JSCoverCommand) that directly incorporates the user-controlled 'source' argument without any sanitization. When this unsanitized input is passed to exec(), it enables arbitrary command execution through shell injection techniques. The combination of user input interpolation in system commands and lack of input validation/sanitization matches the CWE-78 pattern.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

js*ov*r t*rou** *.*.* is vuln*r**l* to *omm*n* Inj**tion. It *llows *x**ution o* *r*itr*ry *omm*n* vi* t** sour** *r*um*nt.

Reasoning

T** vuln*r**ility o**urs in t** *omm*n* *onstru*tion *t lin* ** *n* su*s*qu*nt *x**ution vi* `**il*_pro**ss.*x**`. T** *o** *uil*s * J*v* *omm*n* strin* (`JS*ov*r*omm*n*`) t**t *ir**tly in*orpor*t*s t** us*r-*ontroll** 'sour**' *r*um*nt wit*out *ny s