CVE-2024-36138: Bypass incomplete fix of CVE-2024-27980
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via childprocess.spawn / childprocess.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
Other sources
Node.js could allow a remote attacker to execute arbitrary commands on the system, caused by the incomplete fix of CVE-2024-27980 which was the improper handling of batch files in childprocess.spawn / childprocess.spawnSync. By sending a specially crafted command line argument, an attacker could exploit this vulnerability to inject and execute arbitrary commands on the system.
— IBM
The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all possible extensions on Windows via childprocess.spawn / childprocess.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
This vulnerability affects all users of childprocess.spawn and childprocess.spawnSync on Windows in all active release lines.
— Node.Js
The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all possible extensions on Windows via childprocess.spawn / childprocess.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.4Fixed in 20.15.1Fixed in 22.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.15.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.4.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-36138?
CVE-2024-36138 is classified as a high-severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2024-36138?
To mitigate CVE-2024-36138, update to IBM Planning Analytics versions beyond 2.1 or 2.0, which contain the patched code.
What software is affected by CVE-2024-36138?
CVE-2024-36138 affects IBM Planning Analytics versions 2.1 and 2.0.
What type of vulnerability is CVE-2024-36138?
CVE-2024-36138 is a command injection vulnerability that allows attackers to execute arbitrary commands.
What was the cause of CVE-2024-36138?
The vulnerability was caused by improper handling of batch files through the child_process.spawn method in Node.js.