CVE-2018-21268

The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 MITRE

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.29% chance of exploitation in the next 30 days, 91st percentile

Published

2020-06-25

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://snyk.io/vuln/npm:traceroute:20160311

Security advisories

• jaw187/node-traceroute/tags
• https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-act…
• https://www.npmjs.com/advisories/1465
• https://www.npmjs.com/package/traceroute
• https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package
• advisories/GHSA-8j9v-qhp4-wv55

References

• CVE Record
• NVD entry