cve/2024/CVE-2024-21488.md

CVE-2024-21488

Description

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

POC

Reference

• https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c
• https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371

Github

No PoCs found on GitHub currently.