VDB
CVE-2021-34083
CVE-2021-34083
PUBLISHED
CVSS 8.100000381469727 HIGH
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially exposing the server to RCE.
EPSS 2.08% · 80.6th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
2.08%
80.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| google-it_project | google-it | 0 |
| npm | google-it | 0 |
| n/a | n/a | n/a |
Timeline
- Jun 1, 2022 CVE Published
- Jun 2, 2022 EPSS Score
- Jul 22, 2022 EPSS Score
- Sep 9, 2022 EPSS Score
- Dec 15, 2022 EPSS Score
- Feb 2, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 23, 2023 EPSS Score
- Jun 29, 2023 EPSS Score
- Aug 16, 2023 EPSS Score
- Oct 4, 2023 EPSS Score
- Nov 22, 2023 EPSS Score
References
- https://advisory.checkmarx.net/advisory/CX-2021-4777 url
- https://nvd.nist.gov/vuln/detail/CVE-2021-34083 advisory
- https://github.com/PatNeedham/google-it package
- https://github.com/PatNeedham/google-it/blob/v1.6.2/src/googleIt.js#L34 url
- https://github.com/PatNeedham/google-it/blob/v1.6.2/lib/googleIt.js#L59 exploit