CVE-2021-23326 - OpenCVE

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
The-guild	Graphql-tools

Configuration 1 [-]

cpe:2.3:a:the-guild:graphql-tools:*:*:*:*:*:*:*:*

References

Link	Resource
https://advisory.checkmarx.net/advisory/CX-2020-4300	Third Party Advisory
https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac	Patch Third Party Advisory
https://github.com/ardatan/graphql-tools/pull/2470	Patch Third Party Advisory
https://github.com/ardatan/graphql-tools/releases/tag/%40graphql-tools%2Fgit-loader%406.2.6	Release Notes Third Party Advisory
https://snyk.io/vuln/SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543	Product Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: snyk

Published: 2021-01-20T00:00:00

Updated: 2021-03-30T18:37:04

Reserved: 2021-01-08T00:00:00

Link: CVE-2021-23326

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-01-20T13:15:12.893

Modified: 2022-06-28T14:11:45.273

Link: CVE-2021-23326

JSON object: View

Redhat Information

No data.

CWE

CWE-78

{"containers": {"cna": {"affected": [{"product": "@graphql-tools/git-loader", "vendor": "n/a", "versions": [{"lessThan": "6.2.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Dotan Simha"}], "datePublic": "2021-01-20T00:00:00", "descriptions": [{"lang": "en", "value": "This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Command Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-03-30T18:37:04", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ardatan/graphql-tools/pull/2470"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ardatan/graphql-tools/releases/tag/%40graphql-tools%2Fgit-loader%406.2.6"}, {"tags": ["x_refsource_MISC"], "url": "https://advisory.checkmarx.net/advisory/CX-2020-4300"}], "title": "Command Injection", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2021-01-20T12:25:48.608630Z", "ID": "CVE-2021-23326", "STATE": "PUBLIC", "TITLE": "Command Injection"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "@graphql-tools/git-loader", "version": {"version_data": [{"version_affected": "<", "version_value": "6.2.6"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Dotan Simha"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543"}, {"name": "https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac", "refsource": "MISC", "url": "https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac"}, {"name": "https://github.com/ardatan/graphql-tools/pull/2470", "refsource": "MISC", "url": "https://github.com/ardatan/graphql-tools/pull/2470"}, {"name": "https://github.com/ardatan/graphql-tools/releases/tag/%40graphql-tools%2Fgit-loader%406.2.6", "refsource": "MISC", "url": "https://github.com/ardatan/graphql-tools/releases/tag/%40graphql-tools%2Fgit-loader%406.2.6"}, {"name": "https://advisory.checkmarx.net/advisory/CX-2020-4300", "refsource": "MISC", "url": "https://advisory.checkmarx.net/advisory/CX-2020-4300"}]}}}}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2021-23326", "datePublished": "2021-01-20T00:00:00", "dateReserved": "2021-01-08T00:00:00", "dateUpdated": "2021-03-30T18:37:04", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:the-guild:graphql-tools:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2F072CE-E503-488D-99E9-74C530587BF7", "versionEndExcluding": "6.2.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection."}, {"lang": "es", "value": "Esto afecta al paquete @graphql-tools/git-loader versiones anteriores a 6.2.6. El uso de exec y execSync en el archivo packages/loaders/git/src/load-git.ts permite una inyecci\u00f3n de comandos arbitrarios"}], "id": "CVE-2021-23326", "lastModified": "2022-06-28T14:11:45.273", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2021-01-20T13:15:12.893", "references": [{"source": "report@snyk.io", "tags": ["Third Party Advisory"], "url": "https://advisory.checkmarx.net/advisory/CX-2020-4300"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ardatan/graphql-tools/pull/2470"}, {"source": "report@snyk.io", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/ardatan/graphql-tools/releases/tag/%40graphql-tools%2Fgit-loader%406.2.6"}, {"source": "report@snyk.io", "tags": ["Product", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}