Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-23330

CVE-2021-23330: Command injection in launchpad

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-23330
GHSA ID
GHSA-7h8x-wmq2-7mff
EPSS Score
0.937%
CWE
CWE-77
Published
4/13/2021
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
launchpadnpm<= 0.7.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability manifests in command construction patterns across multiple files: 1) In instance.js, the stop method builds shell commands using user-controlled process names without proper sanitization. 2) In version.js, browser command paths are concatenated directly into execution commands. The pull request #124 specifically addresses these areas by implementing input sanitization (safe() function) and switching from exec to execFile. The PoC demonstrates exploitation through the Instance constructor and getPid method, which ties to the vulnerable command construction in instance.js.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ll v*rsions o* p**k*** l*un**p** *r* vuln*r**l* to *omm*n* Inj**tion vi* stop.

Reasoning

T** vuln*r**ility m*ni**sts in *omm*n* *onstru*tion p*tt*rns **ross multipl* *il*s: *) In `inst*n**.js`, t** stop m*t*o* *uil*s s**ll *omm*n*s usin* us*r-*ontroll** `pro**ss` n*m*s wit*out prop*r s*nitiz*tion. *) In `v*rsion.js`, *rows*r *omm*n* p*t*