GHSA-2877-693q-pj33

OS Command Injection in GenieACS

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-46704

Packages

Ecosystem	Package	Affected	Fixed in
npm	genieacs	< 1.2.8	1.2.8

Details

As written in the advisory (Markdown source, shown as plain text).

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-46704 advisory
https://github.com/genieacs/genieacs/commit/7f295beeecc1c1f14308a93c82413bb334045af6 web
https://github.com/genieacs/genieacs package
https://github.com/genieacs/genieacs/releases/tag/v1.2.8 web