You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
An official website of the United States government
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a curl/wget command string and ran it with `eval`, so a version field containing command substitution (for example $(id)) was executed by the local shell; and nvm_get_checksum() interpolated the version-derived download slug into an awk program, so a crafted version could execute arbitrary commands via awk's system(). An attacker who controls the configured mirror, supplies mirror content to a user or CI on a non-default mirror, or machine-in-the-middles a non-TLS mirror can ∴ run arbitrary commands with the privileges of the user running nvm. The default mirror (https://nodejs.org over TLS) is not affected. Fixed on master (pending the next tagged release) by passing every argument as a literal argv element instead of using eval, by passing the value to awk as data via -v instead of interpolating it into the program, and by rejecting any version outside the Node.js/io.js version grammar before it is used.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Title: nvm de nvm-sh, Description: nvm (Node Version Manager) hasta la versión 0.40.4 ejecuta comandos arbitrarios a partir de cadenas de versión suministradas por el espejo de Node.js/io.js configurado. Comandos como 'nvm install' leen las versiones disponibles del archivo index.tab del espejo y usan la versión seleccionada, sin sanitización, para construir URLs de descarga y comandos de shell/awk. Dos sumideros se ven afectados por la misma entrada no confiable: nvm_download() construyó una cadena de comando curl/wget y la ejecutó con 'eval', por lo que un campo de versión que contenía sustitución de comandos (por ejemplo, $(id)) fue ejecutado por el shell local; y nvm_get_checksum() interpoló el 'slug' de descarga derivado de la versión en un programa awk, por lo que una versión manipulada podría ejecutar comandos arbitrarios a través de system() de awk. Un atacante que controla el espejo configurado, suministra contenido del espejo a un usuario o CI en un espejo no predeterminado, o realiza un ataque de intermediario en un espejo sin TLS, puede, por lo tanto, ejecutar comandos arbitrarios con los privilegios del usuario que ejecuta nvm. El espejo predeterminado (HTTPS://nodejs.org sobre TLS) no se ve afectado. Corregido en 'master' (pendiente de la próxima versión etiquetada) pasando cada argumento como un elemento literal de argv en lugar de usar 'eval', pasando el valor a awk como datos a través de -v en lugar de interpolarlo en el programa, y rechazando cualquier versión fuera de la gramática de versiones de Node.js/io.js antes de que sea utilizada.
nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a curl/wget command string and ran it with `eval`, so a version field containing command substitution (for example $(id)) was executed by the local shell; and nvm_get_checksum() interpolated the version-derived download slug into an awk program, so a crafted version could execute arbitrary commands via awk's system(). An attacker who controls the configured mirror, supplies mirror content to a user or CI on a non-default mirror, or machine-in-the-middles a non-TLS mirror can ∴ run arbitrary commands with the privileges of the user running nvm. The default mirror (https://nodejs.org over TLS) is not affected. Fixed on master (pending the next tagged release) by passing every argument as a literal argv element instead of using eval, by passing the value to awk as data via -v instead of interpolating it into the program, and by rejecting any version outside the Node.js/io.js version grammar before it is used.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
