logstash-relay@1.1.5

Vulnerabilities

1 via 1 paths

Dependencies

174

Source

npm

Find, fix and prevent vulnerabilities in your code.

Severity
  • 1
Status
  • 1
  • 0
  • 0

critical severity

Command Injection

  • Vulnerable module: connection-tester
  • Introduced through: connection-tester@0.1.2

Detailed paths

  • Introduced through: logstash-relay@1.1.5 connection-tester@0.1.2
    Remediation: Upgrade to logstash-relay@1.2.4.

Overview

connection-tester is a module that tests to check if the connection can be established or host/port reachable for a given host and port. Useful for testing all the connection in your node application at server startup.

Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 15 in index.js.

The following PoC demonstrates the vulnerability:

PoC

var a = require("connection-tester");
a.test("& touch 111","& touch 222",123)

Remediation

Upgrade connection-tester to version 0.2.1 or higher.

References