CVE-2018-6342
react-dev-utils on Windows vulnerable to Remote Code Execution
Also known as GHSA-29gp-92wp-94q8
Published 7 y ago · modified 4 mo ago · JSON
Summary
react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
2.84% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | react-dev-utils | >=1.0.0, <1.0.4 >=2.0.0, <2.0.2 >=3.0.0, <3.1.2 >=4.0.0, <4.2.2 >=5.0.0, <5.0.2 | 1.0.4 2.0.2 3.1.2 4.2.2 5.0.2 |
Affected products
- Facebook react-dev-utils
Classification
- Weakness
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
- github.com /facebook/create-react-app/releases/tag/v1.1.5 · x_refsource_MISC, x_transferred
- github.com /facebook/create-react-app/pull/4866 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-6342 · advisory
- github.com /advisories/GHSA-29gp-92wp-94q8 · advisory
- github.com /facebook/create-react-app · package
- npmjs.com /advisories/695 · web
Sources
- CVE List: CVE-2018-6342
- GitHub Advisory: GHSA-29gp-92wp-94q8
- NVD: CVE-2018-6342
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.