Skip to content
Log inStart free trial

GHSA-c27g-q93r-2cwf CVE-2024-52011

launch-editor vulnerable to command injection via the crafted request on Windows

High npm
Severity
7.5 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.51%
Chance of exploitation in the next 30 days. Higher than 43.84% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Fix
Available
2 packages have a fixed version

Description

Summary

Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.

Impact

If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor:

  • An attacker can place a file with the malicious filename
  • An attacker can call the launchEditor method with the file argument controlled
  • The launch-editor package is running on Windows

For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.

Patch

This issue has been fixed in the launch-editor version 2.9.0 (commit).

Affected versions

npm

PackageVulnerableFixed in
launch-editor
<= 2.8.2
 No fix yet
launch-editor
< 2.9.0
2.9.0
vite
<= 5.4.8
 No fix yet
vite
< 5.4.9
5.4.9

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

launch-editor npm → 2.9.0

npm
npm install launch-editor@2.9.0
yarn
yarn add launch-editor@2.9.0
pnpm
pnpm add launch-editor@2.9.0

vite npm → 5.4.9

npm
npm install vite@5.4.9
yarn
yarn add vite@5.4.9
pnpm
pnpm add vite@5.4.9

Severity breakdown

CVSS 4.0 7.5

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
None
User interaction
Active
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 8.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Weakness

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

How to prevent it
  • Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
  • Implementation: If possible, ensure that all external commands called from the program are statically created.
  • Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
  • System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-4r4m-qw57-chr8
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
High Known exploited Also affects vite
GHSA-8g5g-mxqh-grgj
Vite: `server.fs.deny` bypassed with queries
Medium Also affects vite
GHSA-vfpm-58rq-9qcg
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Medium Also affects vite
GHSA-rq7h-c2jc-7f22
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
Medium Also affects vite
GHSA-9jrq-w75r-8gcw
Vite: Cross origin script execution through Vite custom middleware
Low Also affects vite
GHSA-r825-w8mm-5pxw
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
Medium Also affects launch-editor
GHSA-698v-4r3x-3vcv
launch-editor: escapeCmdArgs() omits % escaping on Windows
Medium Also affects launch-editor
GHSA-587h-7wmj-h5pm
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
High Also affects launch-editor

Credits: Ry0taK

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor