Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21414

CVE-2021-21414:
Command injection vulnerability in @prisma/sdk in getPackedPackage function

7.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21414
GHSA ID
GHSA-pxcc-hj8w-fmm7
EPSS Score
0.82424%
CWE
CWE-78
Published
4/6/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
@prisma/sdknpm< 2.20.02.20.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability exists in getPackedPackage where user-controlled 'packageDir' was unsafely interpolated into a shell command. The patch replaced string concatenation with shell-quote.quote() for argument escaping. The test case demonstrates exploitation via backtick injection in packageDir parameter. Runtime detection would show getPackedPackage processing malicious input during command string construction before the security fix.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *s o* to**y, w* *r* not *w*r* o* *ny Prism* us*rs or *xt*rn*l *onsum*rs o* t** `@prism*/s*k` p**k*** w*o *r* *****t** *y t*is s**urity vuln*r**ility. T*is issu* m*y l*** to r*mot* *o** *x**ution i* * *li*nt o* t** li*r*ry **lls t** vuln*

Reasoning

T** vuln*r**ility *xists in `**tP**k**P**k***` w**r* us*r-*ontroll** 'p**k****ir' w*s uns***ly int*rpol*t** into * s**ll *omm*n*. T** p*t** r*pl**** strin* *on**t*n*tion wit* `s**ll-quot*.quot*()` *or *r*um*nt *s**pin*. T** t*st **s* **monstr*t*s *xp