by Kastro
Paper/Archive/CVE-2024-3566

CVE-2024-3566

Node.js Node.js — Command injection vulnerability in programing languages on Microsoft Windows operating system.

EPSS 7%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.0.940 × 2018.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Affected

ProductAffectedFixed inSource
Node.js≤ 21.7.2–CNA
GoLangall versions–CNA
Haskelall versions–CNA
nodejs≤ 21.7.2–CISA-ADP
process_library< 1.6.19.01.6.19.0CISA-ADP
rust< 1.77.21.77.2CISA-ADP
thephpgroupall versions–CISA-ADP
yt-dlpall versions–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refflatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windowsreflearn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-wayrefkb.cert.org/vuls/id/123335refcve.org/CVERecord?id=CVE-2024-24576refcve.org/CVERecord?id=CVE-2024-1874refcve.org/CVERecord?id=CVE-2024-22423refkb.cert.org/vuls/id/123335refgithub.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566