Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 26 July 2018.

Which products and versions are affected?

dns-sync (npm) SEMVER:introduced=0,fixed=0.1.1.

Is there a fix for This vulnerability?

Yes. dns-sync (npm): upgrade to 0.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Check whether you run dns-sync (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

dns-sync command injection in resolve function

Severity: info · Published 2018-07-26

The dns-sync npm module is a Node.js DNS resolution utility. Versions before 0.1.1 contain a command injection vulnerability in the resolve API function that allows attackers to execute arbitrary system commands by injecting shell metacharacters into DNS resolution requests.

Technologies: dns-sync (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 26 July 2018.
Which products and versions are affected?: dns-sync (npm) SEMVER:introduced=0,fixed=0.1.1.
Is there a fix for This vulnerability?: Yes. dns-sync (npm): upgrade to 0.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network or with local access, in a software library.
Am I affected?: Check whether you run dns-sync (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dns-sync (npm): upgrade to 0.1.1 or later
```
npm install dns-sync@0.1.1
```

Technical details

The dns-sync module before 0.1.1 is vulnerable to command injection due to unsafe handling of shell metacharacters in the first argument to the resolve API function. An attacker can craft malicious input containing shell metacharacters to execute arbitrary commands on the affected system. The vulnerability requires the attacker to be able to control input passed to the resolve function. A patch was released in version 0.1.1 that properly sanitizes or escapes shell metacharacters.

Affected products

dns-sync dns-sync before 0.1.1

Timeline

2018-07-26: disclosed
0.1.1: patched
2020-06-17: other: advisory withdrawn as accidental duplicate publish

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.