Growl vor 1.10.0 anfällig für (Command Injection)

The impact of this vulnerability is severe. An attacker who can exploit CVE-2017-16042 can gain complete control over the affected system. This could involve installing malware, stealing sensitive data, modifying system configurations, or using the compromised system as a launchpad for further attacks on the network. The ability to execute arbitrary commands effectively grants the attacker root-level access, making it a high-priority security concern. The blast radius extends to any data or services hosted on the compromised server.

Applications and systems that rely on the growl Node.js module for notification functionality are at risk. This includes development environments, production servers, and any system where the module is integrated into custom applications. Specifically, systems that process untrusted user input and pass it directly to the growl module are particularly vulnerable.

• nodejs / server:

  npm list growl

If the output shows a version less than 1.10.0, the system is vulnerable. • nodejs / server:

  find / -name "growl*" -type d -print

This command searches for the growl module directory. Check the version within the directory. • nodejs / server:

  npm audit | grep growl

This command checks for known vulnerabilities in the growl module using npm audit.

1. 2017-12-28Discovery

   discovery

2. 2018-06-08Disclosure

   disclosure

3. 2018-06-08Patch

   patch

1. Veröffentlicht2018-06-08
2. Geändert2023-11-08
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2017-16042 is to immediately upgrade the growl Node.js module to version 1.10.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing strict input validation on any data passed to the growl module. While not a complete solution, this can reduce the attack surface. Additionally, review system logs for any suspicious activity related to the growl module. After upgrading, confirm the fix by attempting to trigger the vulnerable functionality with malicious input and verifying that the command is not executed.