Is CVE-2020-23256 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-23256 being exploited in the wild.

How severe is CVE-2020-23256?

Critical severity, with a CVSS score of 9.8, published 20 January 2023.

Which products and versions are affected?

electerm (npm) <= 1.3.22, SEMVER:introduced=0,last_affected=1.3.22.

Is there a fix for CVE-2020-23256?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-23256 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2020-23256?

Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-23256: Electerm OS command injection via unverified service request

Q: Which products and versions are affected?

electerm (npm) <= 1.3.22, SEMVER:introduced=0,last_affected=1.3.22.

Q: Is there a fix for CVE-2020-23256?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2020-23256 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2020-23256?

Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-23256 · Severity: critical · CVSS 9.8 · Published 2023-01-20

Electerm, an open-source terminal and file transfer client, contains a vulnerability that allows unauthorized users to execute commands on the host system. This could lead to a complete takeover of the computer where the application is installed, potentially exposing sensitive files and corporate data. The issue stems from the application's service accepting unverified requests from the network.

Technologies: electerm (npm). Vendors: npm.

Quick answers

Is CVE-2020-23256 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-23256 being exploited in the wild.
How severe is CVE-2020-23256?: Critical severity, with a CVSS score of 9.8, published 20 January 2023.
Which products and versions are affected?: electerm (npm) <= 1.3.22, SEMVER:introduced=0,last_affected=1.3.22.
Is there a fix for CVE-2020-23256?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-23256 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2020-23256?: Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Electerm version 1.3.22 and earlier is vulnerable to OS command injection (CWE-78) and missing authentication for critical functions (CWE-306). The vulnerability exists because the electerm service processes unverified network requests without proper neutralization of special elements used in OS commands. A remote, unauthenticated attacker can exploit this by sending a specially crafted request to the service, resulting in arbitrary code execution with the privileges of the application. As of the advisory publication, no patched version has been identified in the source material.

Affected products

electerm electerm <= 1.3.22

Identifiers

CVE-2020-23256
GHSA-x73w-g8hx-v7rp

Timeline

2023-01-20: disclosed: NVD publication date
2023-01-20: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.