7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-52011

CVE-2024-52011: launch-editor vulnerable to command injection via the crafted request on Windows

Summary

Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.

Impact

If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor:

An attacker can place a file with the malicious filename
An attacker can call the launchEditor method with the file argument controlled
The launch-editor package is running on Windows

For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.

Patch

This issue has been fixed in the launch-editor version 2.9.0 (commit).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-52011

CVE-2024-52011:

7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
launch-editor	npm	<= 2.8.2	2.9.0
vite	npm	<= 5.4.8	5.4.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a command injection flaw within the launch-editor package, specifically affecting its operation on the Windows platform. The root cause lies in the launchEditor function located in packages/launch-editor/index.js. This function failed to adequately sanitize the file argument before using it to construct a command that would be executed by the Windows command shell (cmd.exe).

The initial implementation attempted to mitigate this by using a regular expression to validate the file name. However, this approach was flawed and could be bypassed. An attacker could provide a malicious file path containing shell metacharacters (e.g., &, |, ;). When the launchEditor function concatenated this path into the command string, cmd.exe would interpret these characters as command separators, leading to the execution of arbitrary commands supplied by the attacker.

The patch rectifies this vulnerability by replacing the inadequate regex validation with a robust escaping mechanism. It introduces helper functions (escapeCmdArgs, doubleQuoteIfNeeded) that properly sanitize and quote the arguments, neutralizing any special characters before they are passed to the shell via childProcess.exec. This ensures that even if a file path contains metacharacters, they are treated as literal parts of the path and not as executable commands.

Vulnerable functions

launchEditor

packages/launch-editor/index.js

The `launchEditor` function is vulnerable because it constructs a command-line string for `cmd.exe` on Windows using a user-provided file path (`file`). The original code attempted to validate the file path with a regex, but this was insufficient. An attacker could craft a file path with special characters (like `&` or `|`) that would be interpreted by `cmd.exe` as a command separator, allowing for arbitrary command execution. The patch fixes this by removing the flawed regex validation and instead properly escaping the arguments before building the command string for `childProcess.exec`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.