GHSA-8gv3-3j7f-wg94
Potential Remote Code Execution vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | nette/application | >= 2.2.0, < 2.2.10 | 2.2.10 |
| Packagist | nette/application | >= 2.3.0, < 2.3.14 | 2.3.14 |
| Packagist | nette/application | >= 2.4.0, < 2.4.16 | 2.4.16 |
| Packagist | nette/application | >= 3.0.0, < 3.0.6 | 3.0.6 |
| Packagist | nette/application | >= 2.0.0, < 2.0.19 | 2.0.19 |
| Packagist | nette/application | >= 2.1.0, < 2.1.13 | 2.1.13 |
Details
As written in the advisory (Markdown source, shown as plain text).
Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE.
Reported by Cyku Hong from DEVCORE (https://devco.re)
### Impact
Code injection, possible remote code execution.
### Patches
Fixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13
References
External links from the advisory. They lead to third-party sites.
- https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
- https://nvd.nist.gov/vuln/detail/CVE-2020-15227
- https://blog.nette.org/en/cve-2020-15227-potential-remote-code-execution-vulnerability
- https://github.com/FriendsOfPHP/security-advisories/blob/master/nette/application/CVE-2020-15227.yaml
- https://github.com/nette/application
- https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html
- https://packagist.org/packages/nette/application
- https://packagist.org/packages/nette/nette