Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-25890

CVE-2022-25890: wifey vulnerable to Command Injection due to improper input sanitization

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-25890
GHSA ID
GHSA-xj9v-6q2f-vqhx
EPSS Score
0.64544%
CWE
CWE-77
Published
1/9/2023
Updated
1/29/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
wifeynpm<= 2.0.7

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. Multiple sources (GitHub Advisory, NVD, Snyk) explicitly name the connect() function as the injection vector
  2. The provided PoC demonstrates command injection through the SSID parameter passed to connect()
  3. CWE-78 mapping confirms OS command injection pattern
  4. Vulnerability manifests when user-controlled input flows into system commands without validation
  5. While file path isn't disclosed in available data, the function name and attack pattern are clearly identified across all sources

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ll v*rsions o* t** p**k*** wi**y *r* vuln*r**l* to *omm*n* Inj**tion vi* t** `*onn**t()` *un*tion *u* to improp*r input s*nitiz*tion.

Reasoning

*. Multipl* sour**s (*it*u* **visory, NV*, Snyk) *xpli*itly n*m* t** *onn**t() *un*tion *s t** inj**tion v**tor *. T** provi*** Po* **monstr*t*s *omm*n* inj**tion t*rou** t** SSI* p*r*m*t*r p*ss** to *onn**t() *. *W*-** m*ppin* *on*irms OS *omm*n* in
CVE-2022-25890: Wifey connect() RCE Attack | Miggo