OS command injection in aws-lambda · CVE-2019-10777 · GitHub Advisory Database · GitHub

OS command injection in aws-lambda

Critical severity GitHub Reviewed Published Feb 14, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

aws-lambda (npm)

Affected versions

<= 1.0.4

Patched versions

1.0.5

Description

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName".

References

Reviewed Feb 13, 2020

Published to the GitHub Advisory Database Feb 14, 2020

Last updated Jan 9, 2023

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H