CVE-2021-34083

 

Published at: - 02-06-2022 04:15

Last modified: - 09-06-2022 08:17

Total changes: - 2

Description

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially exposing the server to RCE.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/PatNeedham/google-it/blob/v1.6.2/src/googleIt.js#L34
• https://github.com/PatNeedham/google-it/blob/v1.6.2/lib/googleIt.js#L59
• https://advisory.checkmarx.net/advisory/CX-2021-4777

 

Keywords

NVD

 

CVE-2021-34083

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures