9

CVE-2019-19609

Exploit
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Strapi ≫ Strapi Version <= 1.6.4
Strapi ≫ Strapi Version 3.0.0 Update alpha10.1
Strapi ≫ Strapi Version 3.0.0 Update alpha10.2
Strapi ≫ Strapi Version 3.0.0 Update alpha10.3
Strapi ≫ Strapi Version 3.0.0 Update alpha11
Strapi ≫ Strapi Version 3.0.0 Update alpha11.1
Strapi ≫ Strapi Version 3.0.0 Update alpha11.2
Strapi ≫ Strapi Version 3.0.0 Update alpha11.3
Strapi ≫ Strapi Version 3.0.0 Update alpha12
Strapi ≫ Strapi Version 3.0.0 Update alpha12.1
Strapi ≫ Strapi Version 3.0.0 Update alpha12.1.3
Strapi ≫ Strapi Version 3.0.0 Update alpha12.2
Strapi ≫ Strapi Version 3.0.0 Update alpha12.3
Strapi ≫ Strapi Version 3.0.0 Update alpha12.4
Strapi ≫ Strapi Version 3.0.0 Update alpha12.5
Strapi ≫ Strapi Version 3.0.0 Update alpha12.6
Strapi ≫ Strapi Version 3.0.0 Update alpha12.7
Strapi ≫ Strapi Version 3.0.0 Update alpha12.7.1
Strapi ≫ Strapi Version 3.0.0 Update alpha13
Strapi ≫ Strapi Version 3.0.0 Update alpha13.0.1
Strapi ≫ Strapi Version 3.0.0 Update alpha13.1
Strapi ≫ Strapi Version 3.0.0 Update alpha14
Strapi ≫ Strapi Version 3.0.0 Update alpha14.1
Strapi ≫ Strapi Version 3.0.0 Update alpha14.1.1
Strapi ≫ Strapi Version 3.0.0 Update alpha14.2
Strapi ≫ Strapi Version 3.0.0 Update alpha14.3
Strapi ≫ Strapi Version 3.0.0 Update alpha14.4.0
Strapi ≫ Strapi Version 3.0.0 Update alpha14.5
Strapi ≫ Strapi Version 3.0.0 Update alpha15
Strapi ≫ Strapi Version 3.0.0 Update alpha16
Strapi ≫ Strapi Version 3.0.0 Update alpha17
Strapi ≫ Strapi Version 3.0.0 Update alpha18
Strapi ≫ Strapi Version 3.0.0 Update alpha19
Strapi ≫ Strapi Version 3.0.0 Update alpha20
Strapi ≫ Strapi Version 3.0.0 Update alpha21
Strapi ≫ Strapi Version 3.0.0 Update alpha22
Strapi ≫ Strapi Version 3.0.0 Update alpha23
Strapi ≫ Strapi Version 3.0.0 Update alpha23.1
Strapi ≫ Strapi Version 3.0.0 Update alpha24
Strapi ≫ Strapi Version 3.0.0 Update alpha24.1
Strapi ≫ Strapi Version 3.0.0 Update alpha25
Strapi ≫ Strapi Version 3.0.0 Update alpha25.1
Strapi ≫ Strapi Version 3.0.0 Update alpha25.2
Strapi ≫ Strapi Version 3.0.0 Update alpha26
Strapi ≫ Strapi Version 3.0.0 Update alpha26.1
Strapi ≫ Strapi Version 3.0.0 Update alpha26.2
Strapi ≫ Strapi Version 3.0.0 Update alpha4
Strapi ≫ Strapi Version 3.0.0 Update alpha4.8
Strapi ≫ Strapi Version 3.0.0 Update alpha5.3
Strapi ≫ Strapi Version 3.0.0 Update alpha5.5
Strapi ≫ Strapi Version 3.0.0 Update alpha6.3
Strapi ≫ Strapi Version 3.0.0 Update alpha6.4
Strapi ≫ Strapi Version 3.0.0 Update alpha6.7
Strapi ≫ Strapi Version 3.0.0 Update alpha7.2
Strapi ≫ Strapi Version 3.0.0 Update alpha7.3
Strapi ≫ Strapi Version 3.0.0 Update alpha8
Strapi ≫ Strapi Version 3.0.0 Update alpha8.3
Strapi ≫ Strapi Version 3.0.0 Update alpha9
Strapi ≫ Strapi Version 3.0.0 Update alpha9.1
Strapi ≫ Strapi Version 3.0.0 Update alpha9.2
Strapi ≫ Strapi Version 3.0.0 Update beta0
Strapi ≫ Strapi Version 3.0.0 Update beta1
Strapi ≫ Strapi Version 3.0.0 Update beta10
Strapi ≫ Strapi Version 3.0.0 Update beta11
Strapi ≫ Strapi Version 3.0.0 Update beta12
Strapi ≫ Strapi Version 3.0.0 Update beta13
Strapi ≫ Strapi Version 3.0.0 Update beta14
Strapi ≫ Strapi Version 3.0.0 Update beta15
Strapi ≫ Strapi Version 3.0.0 Update beta16
Strapi ≫ Strapi Version 3.0.0 Update beta16.1
Strapi ≫ Strapi Version 3.0.0 Update beta16.2
Strapi ≫ Strapi Version 3.0.0 Update beta16.3
Strapi ≫ Strapi Version 3.0.0 Update beta16.4
Strapi ≫ Strapi Version 3.0.0 Update beta16.5
Strapi ≫ Strapi Version 3.0.0 Update beta16.6
Strapi ≫ Strapi Version 3.0.0 Update beta16.7
Strapi ≫ Strapi Version 3.0.0 Update beta16.8
Strapi ≫ Strapi Version 3.0.0 Update beta17
Strapi ≫ Strapi Version 3.0.0 Update beta17.1
Strapi ≫ Strapi Version 3.0.0 Update beta17.2
Strapi ≫ Strapi Version 3.0.0 Update beta17.3
Strapi ≫ Strapi Version 3.0.0 Update beta17.4
Strapi ≫ Strapi Version 3.0.0 Update beta17.5
Strapi ≫ Strapi Version 3.0.0 Update beta17.6
Strapi ≫ Strapi Version 3.0.0 Update beta17.7
Strapi ≫ Strapi Version 3.0.0 Update beta2
Strapi ≫ Strapi Version 3.0.0 Update beta3
Strapi ≫ Strapi Version 3.0.0 Update beta4
Strapi ≫ Strapi Version 3.0.0 Update beta5
Strapi ≫ Strapi Version 3.0.0 Update beta6
Strapi ≫ Strapi Version 3.0.0 Update beta7
Strapi ≫ Strapi Version 3.0.0 Update beta8
Strapi ≫ Strapi Version 3.0.0 Update beta9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 54.08% 0.989
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html
Third Party Advisory
Exploit
VDB Entry
https://bittherapy.net/post/strapi-framework-remote-code-execution/
Third Party Advisory
Exploit
https://github.com/strapi/strapi/pull/4636
Patch
Third Party Advisory