OS Command Injection

2022-06-0602:59:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

69.7%

JSON

docker-tester is vulnerable to OS command injection. The vulnerability exists in the port attribute in the getExternalPort function of docker-compose.js, allowing an attacker to inject and execute malicious commands through the docker-compose.yml by providing shell meta characters.

CPENameOperatorVersion
docker-testerle1.2.2
docker-testerle1.2.2

CPE	Name	Operator	Version
	docker-tester	le	1.2.2
	docker-tester	le	1.2.2

References

advisory.checkmarx.net/advisory/CX-2021-4786

advisory.checkmarx.net/advisory/CX-2021-4786/

github.com/advisories/GHSA-rj88-4777-828h

github.com/mintzo/docker-tester/blob/v1.2.1/src/docker-compose.js#L18

www.npmjs.com/package/docker-tester

0.003 Low

EPSS

Percentile

69.7%

JSON

Related for VERACODE:35883